This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can’t capture any traffic after i set filters

0

Before I set filters,I can capture traffics ,such as:
alt text

But after I set a TCP filters,I capture nothing,such as:
alt text alt text

Does anyone know what happened and how to fix it? Thanks a lot

asked 03 Jan '15, 02:18

obo's gravatar image

obo
613
accept rate: 0%


One Answer:

3

Capture filters are fairly simple compared to display filters, due to the need for performance. They're really BPF filters. When you use a capture filter of "tcp", the resultant filter logic expects to see that transport type at specific offsets in packets - for example it expects to see the IP header at a specific offset relative to the Ethernet header, and the IP header's protocol field at a specific offset to determine tcp vs. udp and so on.

In your case you're not running "normal" IP over Ethernet - you're running PPP over Ethernet. So I believe you need to tell the capture filter to account for that change in offsets due to PPPoE, by using the filter "pppoes and tcp".

answered 03 Jan '15, 09:42

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

Yes,I'm running PPP over Ethernet.Your method works.thank you.

(04 Jan '15, 01:22) obo