Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter Everything

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 28, 2011, at 11:38 AM, Chuck B wrote:

> At the moment I am less interested in the ports used as I am in identifying the servers that the app connects to. Once I identify all the servers I figure it should be possible to create a filter that excludes all but those servers.

If by "servers" you're referring to particular machines, you should be able to construct a capture filter of the form "host XXX or host YYY or host ZZZ" once you know those machines' host names or IP addresses.