Wireshark · Ethereal-users: Re: [Ethereal-users] TCP Filter problem

[Ulf Lamping <ulf.lamping@xxxxxx>]

Ron Apuzzo wrote:

>
> I downloaded the latest ethereal version 0.10.11 today. I can see all
> TCP and other traffic fine. Then I tried to put in a very simple
> filter "tcp port 23" and tried to telnet from host A(ethereal host) to
> host B. The result is only traffic from host A->B(23) was captured but
> not from B(23)->A. Promiscuous mode was turned off.
>
> When I tried other TCP ports, same result! it never captured incoming
> traffic to the host running ethereal. Again with no filter I would see
> traffic from both directions which makes me believe that this is the
> problem of ethereal filtering. This is 100% reproducable.
>
> Any hints or suggestions that I could try? I just want to capture
> traffic from A:xxxx <-> B:fixed_port but I want to capture both ways.

As you didn't mention -- the "tcp port 23" looks like a capture filter.

The capture filters are transferred directly to the underlying
libpcap/WinPcap, Ethereal is (and can) nothing do against it.

You may use a different libpcap/WinPcap and/or network card which
behaves differently than before.

Regards, ULFL