No packet with capture filter [closed]
Hello community,
I want to capture traffic to internet with capture filter.
For that I use a VLAN on a cisco switch with port mirror to the vlan, existing of only two ports.
One port for ethernet output of a dsl-modem, one port to ethernet inferface o the internet router.
When I start capturing I see all packets an can set a display filter which works.
Stopping capturing and setting a capture filter, like port 5050, no more packet are captured.
No tested capture filter will work.
What is wrong?
Thanks for any help
Michael
Are you setting the capture filter on the Welcome Screen ?
If so, select the interface to capture on then enter the capture filter.
Hello Chuckc thanks for answer. I tried two ways First at wireshark start - selecting interface setting capture filter. Second way: at running wireshark - Option Capture - stopping capture - setting option with new filter, example port 5060 - restart capture. no packets in any way. Michael
Is there a VLAN header on the packets?
For testing, does a capture filter of
vlanwork?What about
vlan and port 5050orvlan and port 5060?Hello Chuckc, same problem. The port on cisco switch are on vlan 3 as operational vlan. cisco mirror port shows traffic von vlan 3 Filter vlan dosen't work. Filter vlan 3 dosen't work Filter vlan 3 and port 5060 dosen't work Last line of wireshark screen says: Ethnert <live capture="" in="" progress=""> No packets. Switching off the capture filter all packets visible. Here I can set a dispaly filter like "sip" an this will filter all traffic on port 5060. Looking at a selectet packet in this case I can't see a information of vlan in the frame.
To the community,
could it be a problem of the protokoll or frames? Protokoll is PPPoE and frames are greater than 1500 bit. If it is so, how can I solve this?
MichaelP