I can set a display filter just fine; why don capture filters work?
Capture filters currently use a different syntax than display filters. Here’s the corresponding section from the wireshark(1) man page: “Display filters in Wireshark are very powerful; more fields are filterable in Wireshark than in other protocol analyzers, and the syntax you can use to create your filters is richer. As Wireshark progresses, expect more and more protocol fields to be allowed in display filters. Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of the pcap library. This syntax is different from the display filter syntax.” The capture filter syntax used by libpcap can be found in the tcpdump(8) man page.
