This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture TCP and UDP packets on port 80

0

can you capture TCP and UDP packets on port 80? i saw the filter command tcp.port == 80 || udp.port == 80 but thats just an or so i changed it to "and" with tcp.port == 80 && udp.port == 80 but that didnt do much of anything. any help would be nice thank you

asked 29 Feb '16, 13:55

cadel546's gravatar image

cadel546
6113
accept rate: 0%


2 Answers:

2

You original display filter was correct.

With both the capture and display filters you are specifying what packets you want to see/capture. With the display filter "tcp.port == 80 || udp.port == 80" you are looking for packets which are TCP or UDP ports 80.

With the display filter "tcp.port == 80 && udp.port == 80" you are looking for traffic which is TCP and UDP port 80 however a packet cannot be both TCP and UDP at the same time (without complicated encapsulation that's out of scope of this thread anyway).

Luke

answered 29 Feb '16, 16:21

sludge3000's gravatar image

sludge3000
6113
accept rate: 50%

That's what I needed to know. I had an idea but I wasn't sure thank you so much

(29 Feb '16, 16:27) cadel546

0

Those filters are display filters. If you are trying to filter during a capture, you need to provide the correct filter:

port 80

If you want to filter all HTTP traffic, then it would be

port 80 or port 8080

answered 29 Feb '16, 14:34

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%

Yeah I forgot to mention that just display filters is fine. But even when I write udp && TCP in the display filter is not showing anything so I'm wondering if there's anything wrong with my wireshark installation or something

(29 Feb '16, 14:40) cadel546

I was thinking because you can only listen to one thing at a time on the same port?? Yeah..I don't really know

(29 Feb '16, 15:18) cadel546