Filter Troubleshooting with Wireshark

Links

Wireshark

Filtering – Order of Precedence 

Cisco SPAN Configuration

Wireshark Filter

tcp.port==81 and (ip.dst == 131.109.29.248 or ip.dst == 131.109.29.249 or ip.dst == 131.109.29.250 or ip.addr == 131.109.29.251) and data contains IPGROUP

*Note: if you’re using your own content filter, the IPs referenced above should be updated to reflect the IP of that filter.