So, I've filtered out a bunch of packets by writing some clever rule. I still see all the TCP Ack packets that were responses to the packets I don't want to see. Is there a way to hide those also, but without hiding ALL ack packets? I'd like to see the ack packets of the remaining (interesting) non-ack packets.
Not by a filter. A filter is basically a pass\fail for each individual packet to be displayed, it can't associate info between packets.
You might be able to cobble something together from the command line by inverting the filter to output the packets that are dropped and noting the tcp sequence numbers of those packets and then creating a filter for ACKs to those sequence numbers.
If you're only looking at higher layers in the stack you can drop all the tcp only packets by including a filter for the higher protocol, e.g. "http".
Asked: 2018-02-22 16:21:34 +0000
Seen: 2,273 times
Last updated: Feb 22 '18
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
