Wireshark-users: Re: [Wireshark-users] Capture Filter

From: Sake Blok <sake@xxxxxxxxxx>
Date: Mon, 3 Dec 2007 17:39:40 +0100

On Mon, Dec 03, 2007 at 10:05:39AM +0300, Asif wrote:
> Stephen Fisher wrote:
> > On Mon, Dec 03, 2007 at 09:33:19AM +0300, Asif wrote:
> >   
> >> I want help on how to create Capture Filter for a specific host.
> >
> > See:
> > http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html
> >
> Thanks Stephen...
> 
> I tested with the following command but no luck
> tcp port 8080 and host 192.168.2.11
> 
> requirement was to capture traffic through and fro for IP 192.168.2.11 
> on TCP port 8080

That's the correct filter, but your traffic might me VLAN-tagged. In which
case you might want to have a look at:

http://wiki.wireshark.org/CaptureSetup/VLAN#head-6bf591391ffef059629a9eede2b4a3d83fdb215d

On how to build capture filters on vlan tagged interfaces.

Hope this helps, Cheers,


Sake