Wireshark · Wireshark-users: Re: [Wireshark-users] how to filter a port?

["Small, James" <JSmall@xxxxxxxxxxxx>]

Thanks Ulf--I didn't realize you could do that, I've been doing not
source and not destination - this is much more efficient!

--Jim

> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-
> bounces@xxxxxxxxxxxxx] On Behalf Of Ulf Lamping
> Sent: Monday, February 26, 2007 5:34 AM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] how to filter a port?
> 
> David Drexler wrote:
> > It's either to or from 'http'.  I also tried
> >
> > tcp.port != 80
> >
> > same results.  I want to run the capture realtime and only see the
> > traffic that interests me.
> Your display filter falls under the "A common mistake", try !(tcp.port
> == 80) instead, which is not the same.
> 
> HTTP can be transported over various TCP ports - not only port 80.
> 
> See:
> 
>
http://wiki.wireshark.org/Hyper_Text_Transfer_Protocol?action=show&redir
ec
> t=HTTP
> for protocol info
>
http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSectio
n.
> html
> for capture filters and
>
http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilter
Se
> ction.html
> for display filters
> 
> Regards, ULFL
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users