Capture filter not working as expected
I am capturing traffic from the WAN side of a Draytek 2862 using port mirroring. With no capture filter all works as expected. However I am only interested in specific remote hosts so I create a capture filter of the form ‘pppoes and (src net nnn.nnn.nnn.nnn)’. This works as expected but of course I only see traffic from the source ip. I want to see any response from my router so I modify the capture filter to ‘pppoes and (src net nnn.nnn.nnn.nnn or dst net nnn.nnn.nnn.nnn). No traffic from my router to the destination is seen. The objective is to investigate remote sites probing my vpn - so it may be correct that my system is stealthed and does not respond. But I want to be sure so I repeat the test with a ping from my system to some remote host. With no capture filter I see ping requests and responses. With the filter set as described I only see ping responses. With filter set as ‘pppoes and (dst net nnn.nnn.nnn.nnn)’ I see nothing. Can anyone shed light on this please?
"With no capture filter all works as expected."
When capturing all, is there a display filter that gives the results you want to get with the capture filter?
ppoes and ip.addr == nnn.nnn.nnn.nnn/maskHow does
pppoes and net nnn.nnn.nnn.nnnwork for you? See pcap-filter for more details.I have tested both suggestions 1) Capture all and use display filter 'pppoes and ip,addr == nnn.nnn.nnn.nnn' works as expected and traffic in both directions is visible - I also get the same result using a display filter without 'pppoes and' 2) using capture filter 'pppoes and ip.addr == nnn.nnn.0.0/16' only captures source traffic. The problem with not specifying a capture filter is that the capture file becomes very large very quickly! My hunch is that I may not be using the correct syntax for a capture filter with pppoes... though the UI shows green.
This is the compiled filter (BPF) on Wireshark 4.0.8.
It might be time to start looking at the bytes in the captured packets to see if they would match the filter.
pppoes and net 16.32.48.0 -------------------------- (000) ldh [12] eth.type (001) jeq #0x8864 jt 2 jf 15 0x8864 /* PPPoE Session Protocol */ (002) ldh [20] ppp.protocol (003) jeq #0x21 jt 4 jf 8 0x21 /* Internet Protocol version 4 */ (004) ld [34] ip.src (005) jeq #0x10203000 jt 14 jf 6 (006) ld [38] ip.dst (007) jeq #0x10203000 jt 14 jf 15 (008) jeq #0x806 jt 10 jf 9 #define ETHERTYPE_ARP 0x0806 /* Addr. resolution protocol */ (009) jeq #0x8035 jt 10 jf 15 #define ETHERTYPE_REVARP 0x8035 /* reverse Addr. resolution protocol */ (010) ld [36] (011) jeq #0x10203000 jt 14 jf 12 (012) ld [46] (013) jeq #0x10203000 jt 14 jf 15 (014) ret #262144 (015) ret #0I have made further progress. Thanks to Chuckc for the advice. The reason the capture filter 'pppoes and dst net nnn.nnn.nnn.nnn' does not work is that the outgoing packets have a VLAN tag which displaces the address fields by 4 bytes. Adding to the filter as follows 'vlan and pppoes and dst net nnn.nnn.nnn.nnn' does capture the outgoing packets. Success! The problem now is how to combine the filters to display the associated outgoing and incoming packets. The documentation is clear that the primitives 'vlan' and 'pppoes' persist through the capture filter string and it seems that 'vlan' has to come first. How do I "turn off" that primitive to capture the incoming packets? I want to do something like (vlan && pppoes && dst nnn.nnn.nnn.nnn) or (pppoes && src nnn.nnn.nnn.nnn) but that is not allowed.