This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture filter does not work

0

Hi all

No packets are captured when i try to find out http traffic (tcp port 80). Althuogh I can find them when I capture all packets (e.g. without any capture filter), applying display filter.

I ran Wireshark as administrator but the problem remained.

Windows 7 Wireshark 1.6.5

Thanks in advance

asked 18 Feb '12, 01:36

clipsya's gravatar image

clipsya
1112
accept rate: 0%

edited 18 Feb '12, 01:38

The capture filter "tcp port 80" or "tcp port http" works fine for me. Do you see any traffic with the above filters?

(18 Feb '12, 03:20) grahamb ♦

thanks but both filters "tcp port 80" and "tcp port http" don't capture anything

(18 Feb '12, 05:13) clipsya

And if you remove the capture filter you see tcp traffic on port 80? And you aren't making any other changes? Very odd.

(18 Feb '12, 05:57) grahamb ♦

yes, as I mentioned above if I don't apply any capture filter all of the packets are captured successfuly and I can find http packets among all of it using display filter. But it is not convenient way for me :(

(18 Feb '12, 06:15) clipsya

One Answer:

4

If you do see HTTP packets when you don't use a capture filter and you don't see HTTP when you do use a capture filter, then the capture filter filters the HTTP packets out. This usually happens when traffic is being encapsulated. Depending on the encapsulation type, you need to extend the capture filter:

  • 802.1Q vlan tagging : vlan and tcp port 80
  • PPPoE : pppoes and tcp port 80

If these do not work for you, please update this question with the full (text) output of 1 HTTP packet to check what encapsulation you are encountering.

answered 18 Feb '12, 06:15

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 18 Feb '12, 06:22

Great thanks! PPPoE is my case! I didn' t even think about encapsulation.. Thanks a lot again!

(18 Feb '12, 06:27) clipsya