> the first filter: *tcp port 80 and host 192.168.10.11* do not work whereas the > second: *vlan 254*, *vlan 255*, etc. work fine. My traffic contains vlan > 254, tcp, udp, port 80, port 443 and many ip address including > 192.168.10.11. But when I apply the first one, the pcap result file > contains nothing. (I opened it with wireshark).
Try: vlan and tcp port 80 and host 192.168.10.11 Capture filter may needs to know that about the vlan, so it can look at the correct offset in the packet. But "vlan" should suffice, you don't have to specific which vlan it is. A display filter would work too I guess. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
