Ethereal-users: Re: [Ethereal-users] displaying only TCP data

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Sun, 16 Apr 2006 22:24:58 +0200
On Sun, Apr 16, 2006 at 09:36:13AM -0700, Jun Chang wrote:
> Is there anyway to display only TCP data? I want to filter ACK out and
> display only data portion, but I can't seem to find out how.

You can use tcp.len>0 to filter out the ACK's, but that would also
filter out the SYN, FIN and RST packets. If you still want to see 
those, you can use:
"tcp.flags.syn==1 || tcp.flags.fin==1 || tcp.flags.reset==1 || tcp.len>0"


Hope this helps,   Cheers,   Sake