Filter Capturing

Capture filter syntax differs from display filter syntax, so to capture only 10.10.10.1, you need to use host 10.10.10.1.

However, there is no capture syntax for fqdn (like www.youtube.com) for many reasons:

• translation of fqdn to IP address is done using DNS, and there is no feedback from the dissection of the DNS response to the capture filter, leaving aside that the DNS responses are locally cached

• a single fqdn may translate to several IP addresses (for load sharing and reliability purposes)

• several fqdns may be hosted on a single IP address so you cannot determine which flow belongs to which fqdn by just the IP address.