Hmmmm. Well, I see the problem, though it opens different questions...
I'm using an HP 2600 series switch. I have 3 vlans, but no ports are
tagged (they are all untagged). The monitoring/mirroring port is
supposed to be on the same vlan as the port you are monitoring. It
wasn't. When I used the filter "vlan and host 65.98.143.227" it worked.
So then I got rid of it and capture filter and verified that indeed the
packets were all being sent, but were tagged. Does that mean that all
ports are sending out packets for all vlans but they're tagged, or it's
sending tagged packets on the monitoring port even if it's not in the
same vlan on the port being monitored?
Anyway, you answered my question! Thanks some much Sake!
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Sake Blok
Sent: 2007-11-15 19:14
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Capture filter not working?
On Thu, Nov 15, 2007 at 05:49:57PM -0800, Trevor Tolk wrote:
> capture filter:
>
> host 65.98.143.227
Could it be that the frames coming from the mirrored port are
vlan-tagged (if so, they have a [802.1q] header in the packet detail
pane).
If they are, you must use the capture filter "vlan and host
65.98.143.227"
Hope this helps, Cheers,
Sake
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
