Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter not work for hub, seems like a bug?

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Tao Zhou wrote:
> Yes, the http traffic is on port 80, not on other ports.
> 
> as I said in the first email, that if I use 'Display Filter' as http
> while leaving the 'Capture Filter' empty, the http traffic could be
> filtered out on port 80;
> However, if use 'port 80' as 'Capture Filter' while leaving 'Display
> Filter' empty, no traffic could be captured.
> 
> But today I found that the laptop NIC card has not obtained a valid IP
> address, as it uses DHCP; while STB got an public network IP address
> through PPPoE.
> So I guess maybe the root cause is that without an IP address for
> laptop, the 'Capture Filter' will make it could not capture any packets;
> while leaving it empty will get all packets in the hub successfully.

Are you trying to apply a capture filter to PPPoE traffic? If so, you
might want to try something like "pppoes && port 80". According to the
tcpdump man page you need to use it in order for your filter to use the
proper offsets.