Revision history [back]

The way I would troubleshoot this is to make a small capture without capture filter (say 10000 packets) and then do the same with the capture filter. Have a look at the "Statistics -> Conversations" overview and check the "Ethernet" tab to see whether every packet has one of the mac addresses from your filter. I suspect that ine of the endpoints is sending a lot of data.

I'm trying to capture traffic between two sets of two endpoints. If the purpose of your filter is to capture between two endpoints, the filter should have the form:

ether host <mac-addrsystem1> and ether host <mac-addr system2>

or

(ether src mac1 or ether dst mac1) and (ether src mac2 or ether dst mac2)

The filters you mentioned collect all packets that were either sent or received by either of those two hosts, independent of whom they were sending to or receiving from.

The way I would troubleshoot this is to make a small capture without capture filter (say 10000 packets) and then do the same with the capture filter. Have a look at the "Statistics -> Conversations" overview and check the "Ethernet" tab to see whether every packet has one of the mac addresses from your filter. I suspect that ine of the endpoints is sending a lot of data.

I'm trying to capture traffic between two sets of two endpoints. endpoints.

If the purpose of your filter is to capture between two endpoints, the filter should have the form:

ether host <mac-addrsystem1> and ether host <mac-addr system2>

or

(ether src mac1 or ether dst mac1) and (ether src mac2 or ether dst mac2)

The filters you mentioned collect all packets that were either sent or received by either of those two hosts, independent of whom they were sending to or receiving from.