title: WireShark Remote Capture failed:NFLOG link-layer type filtering not implemented
body: <p>I followed <a href="https://wiki.wireshark.org/CaptureSetup/Pipes#Remote_Capture" rel="nofollow noreferrer">the official documentation</a>.</p>
  <p>My remote-server is CentOS 7.9, and I have installed the wireshark in it.</p>
  <p>I use the below command to open my <strong>local wireshark software</strong> to capture the remote-server's interface packet:</p>
  <pre><code>ssh root@remote-server-name 'dumpcap -w - -f &quot;not port 22&quot;' | wireshark -k -i -
  </code></pre>
  <p>but I get error information:</p>
  <pre><code>Capturing on 'nflog'
  dumpcap: Invalid capture filter &quot;not port 22&quot; for interface nflog!
  
  That string isn't a valid capture filter (NFLOG link-layer type filtering not implemented).
  See the User's Guide for a description of the capture filter syntax.
  </code></pre>
  <p>and my <strong>local wireshark software</strong> display the error:
  <a href="https://i.stack.imgur.com/E1u6R.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/E1u6R.png" alt="k" /></a></p>
  <hr />
  <p><strong>EDIT-01</strong></p>
  <p>I use the below command to special the interface:</p>
  <pre><code>ssh root@remote-server-name -i .ssh/id_rsa 'dumpcap -w - -f &quot;not port 22&quot;' | wireshark -k -i em1
  </code></pre>
  <p>but the wireshark says there is no such device:
  <a href="https://i.stack.imgur.com/l5bPW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/l5bPW.png" alt="enter image description here" /></a></p>
  <p>in my server there exist the <code>em1</code> indeed.</p>
  <pre><code>[root@att ~]# ip a | grep em1
  2: em1: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq state UP group default qlen 1000
      inet remote-ip/29 brd remote-ip scope global noprefixroute em1
  </code></pre>