On Thu, Nov 15, 2007 at 05:49:57PM -0800, Trevor Tolk wrote: > capture filter: > > host 65.98.143.227
Could it be that the frames coming from the mirrored port are vlan-tagged (if so, they have a [802.1q] header in the packet detail pane). If they are, you must use the capture filter "vlan and host 65.98.143.227" Hope this helps, Cheers, Sake _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
