Wireshark-users: Re: [Wireshark-users] how to filter a port?
From: Ulf Lamping <[email protected]>
Date: Mon, 26 Feb 2007 11:33:40 +0100
David Drexler wrote:
It's either to or from 'http'.  I also tried

tcp.port != 80

same results. I want to run the capture realtime and only see the traffic that interests me.
Your display filter falls under the "A common mistake", try !(tcp.port == 80) instead, which is not the same.
HTTP can be transported over various TCP ports - not only port 80.

See:

http://wiki.wireshark.org/Hyper_Text_Transfer_Protocol?action=show&redirect=HTTP for protocol info http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html for capture filters and http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html for display filters
Regards, ULFL