Wireshark-users: Re: [Wireshark-users] Destination capture filtering not working

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 04 Jan 2008 12:45:41 -0800

Cliff Fogle wrote:

This also applies to tcpdump.

Not surprising, as this is probably a libpcap issue, and both tcpdump and Wireshark/TShark use libpcap to do capturing.

If I do an unfiltered capture and use a display
filter I see these packets,

If you look at those packets, is there an 802.1Q VLAN header between the Ethernet header and the IP header?

If so, you need to prefix the filters with "vlan and", e.g. "vlan and dst port 80".