I trying to use the bridge filter to look for traffic from a specific IP address. If I Torch the bridge interface I see all the traffic including what I’m looking for, and it shows the Eth. Protocol 800(ip). If I enable the Bridge Filter and want to filter by IP, it requires changing the Mac-Protocol to ip(800). When I do this, even if I leave to src-address blank or ether 0.0.0.0/0 I get nothing through the filter. If leave the Mac-Protocol blank, I once again see all the traffic through the bridge filter.
Any ideas what is happening.
If I try and use the firewall filter instead. I can filter by IP and it works great, but then the src mac address is not included in the log.
Thanks for any help.