show tcp streams which don't include string

edit

You can split the filter into the two elements, command and parameter. That way you can see all "EHLO" command lines that do not use the parameter "Monitoring\x0d\x0a" by using the following filter:

smtp.req.command == "EHLO" and not smtp.req.parameter == "Monitoring\x0d\x0a"

If you want the full TCP sessions of these packets, you can use something like this in a bash shell:

tshark -r in.pcap -w out.pcap -Y "tcp.stream in {$(tshark -r in.pcap -Y 'smtp.req.command == "EHLO" and not smtp.req.parameter == "Monitoring\x0d\x0a" ' -T fields -e tcp.stream | xargs)}"

Drilled down:

• tshark -r in.pcap -Y <filter> -T fields -e tcp.stream will print all the tcp.stream numbers of the packets that match the filter
• the | xargs will create a list of these stream numbers, separated by spaces
• and tshark -r in.pcap -w out.pcap -Y "tcp.stream in {$(<command>)}" takes the list of stream numbers and uses it as a filter to create a new file with the full TCP sessions

Not directly, the display filter capabilities of Wireshark are "per-packet", i.e. is this packet to be displayed or not. There isn't a direct mechanism to say display this packet because of some condition in another packet.

MATE might be a possible solution as:

MATE's goal is to enable users to filter frames based on information extracted from related frames or information on how frames relate to each other.

You could also use tshark, some scripting and post-processing, e.g. run a first pass on the capture to only include SMTP frames with an EHLO but not the extra text, output the tcp stream numbers for those frames and use that to build a filter for a second pass on the capture to output those streams. Some ideas for this can be found in the SharkFest'18 presentation by @SYN-bit here.