wireshark not capturing FTP on en0

edit

1. How exactly do you filter?
2. How have you blocked FTP on your router?
3. How is it supposed to report blocked FTP?
4. How do you know you have at least one FTP per day? I assume the router reporting?
5. Where does this FTP connection attempt come from? Internal or external network?
6. Have you tested the filter by attempting FTP connections yourself?

In the router I just blocked the service. The report shows in the router logs. It shows the IP source from one device in the network. I installed wireshark on that device in hopes of finding the app that is trying to send the packets.

Thanks for answering question 1-5, this makes the situation much more clear. But can you answer question 6 as well? Furthermore, what do you see when you apply no filter at all? Is the capture usable, as in, do you see normal IP network traffic?

I see all TCP, UDP, IGMP, and broadcast queries for the network. I just tried FTP to another computer in the network, the router blocked it, but no indication on wireshark.

So capturing works, you're seeing network traffic as expected. What are your filter expressions? What happens when you filter on TCP port 21 (the FTP port)?