What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

tcp.src == 25 only matches packets where port 25 is the source port, missing all inbound traffic destined for port 25 and therefore failing to capture all traffic 'to or from' the host.

The syntax host 192.168.0.125:25 is not valid in either BPF capture filter or Wireshark display filter format and will produce a parse error.

port 25 and host 192.168.0.125 is valid BPF capture filter syntax but does not restrict results to TCP-only traffic, potentially including UDP port 25 traffic.

The display filter tcp.port == 25 correctly matches TCP segments where port 25 appears in either the source or destination field, capturing traffic both to and from that port. Combined with ip.host == 192.168.0.125, the full filter isolates all TCP port 25 traffic for that specific host using valid Wireshark display filter syntax, which is the correct approach for this type of targeted capture.