What is the correct PCAP filter to capture all TCP traffic going to or from host 192.168.0.125 on port 25?

The field 'tcp.src == 25' matches only traffic where port 25 is the source port, missing inbound traffic, and 'ip.host' alone does not correctly filter bidirectional host traffic in standard Wireshark syntax.

The syntax 'host 192.168.0.125:25' is not valid in either BPF capture filter or Wireshark display filter notation and would produce a parse error.

'port 25 and host 192.168.0.125' is valid BPF capture filter syntax but does not restrict traffic to TCP specifically, and it uses BPF notation rather than Wireshark display filter field syntax.

The filter 'tcp.port == 25 and ip.host == 192.168.0.125' uses Wireshark display filter syntax, combining the protocol-specific port field (tcp.port) with a host address field joined by the logical AND operator. This correctly restricts results to TCP traffic only on port 25 for the specified IP in either direction, isolating SMTP communication to and from that host.