This is our old Q&A Site. Please post any new questions and answers at

Hi, i have some issues with capture filters not working on a Linux Server. Even a simple filter like "x.x.x.x" will cause no packets to be displayed. If i filter after capture using display filter it works fine "ip.addr==x.x.x.x". I have tried this on a different network interface on the same machine and found capture filters are working fine on that one. The only difference i can think of between those 2 interfaces is that the first one has a lot of traffic on it (250Mbps+). Has anyone else faced a similar problem or knows of certain limitations for capture filters? thanks!

asked 29 Aug '11, 23:34

menumorut's gravatar image

accept rate: 0%

After answering your question, I saw that it was deleted. I think this can be a useful question/answer to others, so I undeleted it. Please add the way you solved your issue as a comment.

(30 Aug '11, 00:35) SYN-bit ♦♦

"x.x.x.x" is not a valid capture filter, you will have to use "host x.x.x.x", but assuming you did indeed use "host x.x.x.x" the problem might be that your packets are encapsulated. This can be either by vlan-tagging, pppoe, mpls etc.

Please capture a few packets without filter, then use the display filter and look for vlan-tagging or a protocol between the ethernet and the ip layer.

If the packets are vlan-tagged, then you can use "vlan and host x.x.x.x" as a capture filter. For other protocols it depends on the protocol what kind of filter you may need to use.

permanent link

answered 30 Aug '11, 00:16

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 29 Aug '11, 23:34

question was seen: 3,651 times

last updated: 30 Aug '11, 00:35

p​o​w​e​r​e​d by O​S​Q​A