Cliff Fogle wrote: > This also applies to tcpdump.
Not surprising, as this is probably a libpcap issue, and both tcpdump and Wireshark/TShark use libpcap to do capturing. > If I do an unfiltered capture and use a display > filter I see these packets, If you look at those packets, is there an 802.1Q VLAN header between the Ethernet header and the IP header? If so, you need to prefix the filters with "vlan and", e.g. "vlan and dst port 80". _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
