 | 1 | initial version |
The 0 packets captured is a bit misleading.
Since you didn't specify a capture filter, tshark (dumpcap actually) has captured packets; it's just that your display filter isn't displaying any of them because none of the captured packets matched the display filter.
If you want to stop capturing after 1 packet, then you need to specify a suitable capture filter, not a display filter. Refer to the pcap-filter man page for help with capture filters.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
