Wireshark · Ethereal-users: Re: [Ethereal-users] displaying only TCP data

[Sake Blok <sake@xxxxxxxxxx>]

On Sun, Apr 16, 2006 at 09:36:13AM -0700, Jun Chang wrote:
> Is there anyway to display only TCP data? I want to filter ACK out and
> display only data portion, but I can't seem to find out how.

You can use tcp.len>0 to filter out the ACK's, but that would also
filter out the SYN, FIN and RST packets. If you still want to see 
those, you can use:
"tcp.flags.syn==1 || tcp.flags.fin==1 || tcp.flags.reset==1 || tcp.len>0"


Hope this helps,   Cheers,   Sake