hi, is it possible to capture from only one port in wireshark and tshark? in wireshark if we use udp.port==1000 in filter tab, all packets capture but only packets with udp.port==1000 are displayed. However i want to capture packets of only one port?
However i want to capture packets of only one port?
That's what capture filters are for.
Those are implemented by libpcap/WinPcap, and (due to the way they're implemented, often in the kernel-mode networking stack) have limited capabilities, so their syntax is different.
The capture filter you'd want would be udp port 1000.
Asked: 2018-06-13 04:24:52 +0000
Seen: 714 times
Last updated: Jun 13 '18
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
