Wireshark-users: Re: [Wireshark-users] Capture filter not working?

From: Sake Blok <sake@xxxxxxxxxx>
Date: Fri, 16 Nov 2007 04:14:27 +0100

On Thu, Nov 15, 2007 at 05:49:57PM -0800, Trevor Tolk wrote:
> capture filter: 
> 
> host 65.98.143.227

Could it be that the frames coming from the mirrored port are
vlan-tagged (if so, they have a [802.1q] header in the packet
detail pane).

If they are, you must use the capture filter "vlan and host 65.98.143.227"

Hope this helps, Cheers,


Sake