Thanks Ulf--I didn't realize you could do that, I've been doing not
source and not destination - this is much more efficient!
--Jim
> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-
> bounces@xxxxxxxxxxxxx] On Behalf Of Ulf Lamping
> Sent: Monday, February 26, 2007 5:34 AM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] how to filter a port?
>
> David Drexler wrote:
> > It's either to or from 'http'. I also tried
> >
> > tcp.port != 80
> >
> > same results. I want to run the capture realtime and only see the
> > traffic that interests me.
> Your display filter falls under the "A common mistake", try !(tcp.port
> == 80) instead, which is not the same.
>
> HTTP can be transported over various TCP ports - not only port 80.
>
> See:
>
>
http://wiki.wireshark.org/Hyper_Text_Transfer_Protocol?action=show&redir
ec
> t=HTTP
> for protocol info
>
http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSectio
n.
> html
> for capture filters and
>
http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilter
Se
> ction.html
> for display filters
>
> Regards, ULFL
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
