Wireshark-users: [Wireshark-users] Wireshark filter "contains" question
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: George Vandelet <george_vandelet@xxxxxxxxx>
Date: Wed, 21 Jul 2010 12:29:47 -0700 (PDT)
I have rececently found the "contains" filter in wireshark which is VERY powerful.  For instance, if I only want to see http packets that contain the string "SOAP" I could used the filter "http contains SOAP".  However, if I wish to use the filter to show http packts that DONT contain the string SOAP, I can not do it!  I have tried using the following without success.
 http contains !(SOAP)
 http contains !SOAP
 http !contains SOAP
 
 Does anyone know a way to  negate the "contains" filter?
 
 Thanks,
 
 George