This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Question on Filtering HTTP

0

I want to filter only http, but when I did that it shows me both ssdp and http. However, if write http and tcp.dstport != 1900 on the display filter command it shows me only http which is what I want. So I dont quite understand why if I type only http on the filter command it doesnt show only http?

asked 07 Jan '15, 02:38

Specialone's gravatar image

Specialone
11●1●1●2
accept rate: 0%

One Answer:

3

http is a display filter that will show all frames that Wireshark recognized (dissected) as HTTP, which includes SSDP (as that's using a 'dialect' of HTTP).

If you don't want to see SSDP, you can use the filter you have mentioned, or remove port 1900 from the HTTP preferences.

Edit -> Preferences -> Protocols -> HTTP -> TCP Ports

Regards
Kurt

answered 07 Jan '15, 02:52

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Thank you very much Kurt for your answer. Appreciate it very much:D

(07 Jan '15, 05:26) Specialone