I've been using tshark to capture packets coming off of a mirrored port so I can see everything that is coming in and going out of our network. I have the link to our ISP mirrored to a monitoring port where my computer that I use for monitoring is plugged into. I haven't had any problems with it when I don't have a capture filter. I see the traffic going both ways. However when I put a capture filter of: "tcp port 80" I only get traffic coming into our network, but nothing going out. Is that the way the capture filter is suppose to work? Is it only suppose to capture incoming packets to that port or is it possible to also show outgoing packets to the port as well. I get the same result whether I try the filter in tshark or wireshark. I'm running wireshark/tshark 1.2.8 so I'm going to update to 1.4.4. libpcap is 1.1.1 The box is running OpenSuse 11.3
Any comments/ideas would be appreciated.
asked 15 Apr '11, 11:28
If you don't use a capture filter, do the incoming and outgoing packets have the same protocol hierarchy? Is there one-way vlan-tagging, pppoe maybe? A capture filter looks at specific offsets in the packet for tcp port numbers. The offset is dependable on the previous protocol layers. So if the protocol layers differ for in the incoming and the outgoing packets, you need to make a capture filter that filters for both of them individually.
Please check the protocol hierarchy (and vlan tagging) and report so we can help you build a proper filter.
answered 15 Apr '11, 11:48