The default columns for Wireshark are: Packet number, Time, Source, Destination, Protocol, Length, and Info (as shown below):

This guide shows how I change the columns in my Wireshark setup. Most people will change their columns from the default configuration. Wireshark is a great tool, but it's default column display doesn't work effectively for the type of analysis I normally do.

I also already tried a different libpcap version (1.3.0-1), but that also did not help.NOTE: I have an updated version of this information posted on the Palo Alto Networks blog at: Now with the filter applied: $ sudo tshark -i eth0 'tcp port 1'Ġ.000000 ::a -> ::c TCP 35982 > tcpmux Seq=4190420215 Ack=4138811225 Win=1024 Len=0 MSS=1460Īny clues how to debug this further? I will try to change the virtual network cards of the machines, maybe this helps. So, yes, I'm sure that there's no VLAN or other things. Wireshark runs on one of the virtual machines. The communication I'm capturing is between two Virtual machines on the same physical PC. Its the same output as you have, except that I specified port 1 in line 6. Thats my output from 'compile BF filter': (000) ldh Also, are you sure your frames are not vlan tagged (or encapsulated in pppoe or something else)? Maybe there is a bug in your version of libpcap indeed. It should show something like this: (000) ldh

Src port wireshark