David Drexler wrote: > It's either to or from 'http'. I also tried > > tcp.port != 80 > > same results. I want to run the capture realtime and only see the > traffic that interests me. Your display filter falls under the "A common mistake", try !(tcp.port == 80) instead, which is not the same.
HTTP can be transported over various TCP ports - not only port 80. See: http://wiki.wireshark.org/Hyper_Text_Transfer_Protocol?action=show&redirect=HTTP for protocol info http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html for capture filters and http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html for display filters Regards, ULFL _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
