Thanks Ulf--I didn't realize you could do that, I've been doing not source and not destination - this is much more efficient!
--Jim > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:wireshark-users- > [EMAIL PROTECTED] On Behalf Of Ulf Lamping > Sent: Monday, February 26, 2007 5:34 AM > To: Community support list for Wireshark > Subject: Re: [Wireshark-users] how to filter a port? > > David Drexler wrote: > > It's either to or from 'http'. I also tried > > > > tcp.port != 80 > > > > same results. I want to run the capture realtime and only see the > > traffic that interests me. > Your display filter falls under the "A common mistake", try !(tcp.port > == 80) instead, which is not the same. > > HTTP can be transported over various TCP ports - not only port 80. > > See: > > http://wiki.wireshark.org/Hyper_Text_Transfer_Protocol?action=show&redir ec > t=HTTP > for protocol info > http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSectio n. > html > for capture filters and > http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilter Se > ction.html > for display filters > > Regards, ULFL > _______________________________________________ > Wireshark-users mailing list > Wireshark-users@wireshark.org > http://www.wireshark.org/mailman/listinfo/wireshark-users _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
