 | 1 | initial version |
The 0 packets captured is a bit misleading.
Since you didn't specify a capture filter, tshark (dumpcap actually) has captured packets; it's just that your display filter isn't displaying any of them because none of the captured packets matched the display filter.
If you want to stop capturing after 1 packet, then you need to specify a suitable capture filter, not a display filter. Refer to the pcap-filter man page for help with capture filters.
