This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why my capture filter captured nothing?

Capture Filter1: port 80
Capture Filter2: port 53
Capture Filter3: udp
My computer connect the ADSL MODEM directly.
Wireshark working well with no capture filter.

wireshark

asked 03 Feb '11, 03:04

xuesha
6●1●1●3
accept rate: 0%

edited 03 Feb '11, 03:06

Today found a situation (with capture filter):
MyPC -> Adsl Modem -> Internet (capture failed)
MyPC-> Router -> Adsl Modem -> Internet (capture success)

According http://wiki.wireshark.org/PPP :
There's currently no support for filtering on any PPP fields other than the protocol.

So I can not use capture filters under ADSL?

(04 Feb '11, 09:06) xuesha

2 Answers:

OK, looks like your packets are PPPoE when directly connected to your ADSL modem, in that case you should use a capture filter like:

pppoes and (port 80)
pppoes and (host 1.1.1.1 and port 53)
etc

answered 04 Feb '11, 09:45

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

to SYNbit ♦:
Depending on your method solved the problem!
Thank you very much!

(04 Feb '11, 10:23) xuesha

You're very welcome, glad it works.

(I converted your "answers" to comments, as that's the way this Q&A is working best)

(04 Feb '11, 11:00) SYN-bit ♦♦

1	Probably your traffic is VLAN tagged. Try this: 'vlan and port 80' answered 03 Feb '11, 11:57 Jaap ♦ 11.7k●16●101 accept rate: 14% to Jaap ♦: but it still captured nothing (03 Feb '11, 20:21) xuesha