Ethereal-users: Re: [Ethereal-users] Problem applying Ethereal filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Wed, 14 Jul 2004 10:31:25 -0700
At 08:38 PM 7/13/2004, Jerome VanRooijen wrote:

I have created a capture of my network, which has various traffic going over
it. The majority of this is FTP, and I would like to filter this out after
the capture stage, but when I apply the filter 'tcp.port != 21', Ethereal
continues to display all packets captured.

Is there something that I am missing?
Yes. TCP packets have two ports, a source and a destination. tcp.port refers to both. 'tcp.port != 21' is equivalent to 'tcp.srcport != 21 or tcp.dstport != 21'. Since in FTP traffic one of the ports is normally not 21, your filter matches all TCP packets.
Try '! tcp.port == 21'. Using 'port' is useful when used with == but has this often unexpected side-effect with !=.