Wireshark-users: Re: [Wireshark-users] pure HTTP capture filer?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 17 Aug 2006 20:24:03 -0700

On Aug 17, 2006, at 6:41 AM, Erik P Vinther wrote:

The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx .
Don't forget to unsubscribe from this list at

Thus, I'm redirecting this to the Wireshark list.

Can i define a pure HTTP capture filer (excluding the tpc)?

What do you mean "excluding the tpc"?

If you mean "excluding the TCP", what does that mean? Do you mean "how do I define a capture filter that captures packets with HTTP traffic but doesn't capture ACK-only packets?" (HTTP runs over TCP, with some rare exceptions, so literally "excluding the TCP" would exclude HTTP as well.)

For TCP over IPv4, see


for an example of a filter that will capture only TCP packets with data (i.e., no ACK-only packets).