Wireshark · Ethereal-users: Re: [Ethereal-users] Capture Filter on port - strange behavior

[Ulf Lamping <ulf.lamping@xxxxxx>]

James Garrison wrote:

> Running on Windows XP SP2 with Ethereal versions
> 0.10.10 and WinPCap 3.0.
>
> If I provide the following capture filter:
>
>     port 25
>
> in order to capture an SMTP transaction, I see only
> packets with destination port 25 -- I.e. I see the
> the client's outgoing packets only.
>
> However, if I capture with NO filter specified, I see
> all packets, so I know WinPCap is capturing all the
> traffic.
>
> I also tried
>
>     src port 25 || dst port 25
>
> but the results were the same. This used to work
> just fine.  Has something changed or am I missing
> something?
>
> I also tried Ethereal 0.10.9 and WinPCap 3.1beta4 with
> the same results.
>
Hmmm, a capture filter is transparently transferred to the WinPcap
driver and the capture filtering is done there, so there's not a lot the
Ethereal team can do about it.

Do you have installed a firewall or Win XP SP2 or a new network card
recently which might caused this problem?

You might ask the WinPcap people about this...

Regards, ULFL