3

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet capturing to only HTTP or maybe only HTTP on port 8080. How can I do this in Wireshark?

On File > Preferences... and under Protocols I have removed the 1900 port from HTTP and 8080 is already there.

I have typed http in the "Filter" textfield, but it doesn't seem to have any effect.

Improve this question

5 Answers 5

Reset to default
2

In the filter field enter tcp.port eq 8080

Ref.: Wireshark: Help -> Manual pages -" Wireshark Filter ...

As far as I know this is an alternate HTTP port in TCP only:

HTTP alternate (http_alt)—commonly used for Web proxy and caching server, or for running a Web server as a non-root user and Apache Tomcat in TCP only

Ref.: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Hope this help. Let us know. :)

Improve this answer
1
  • This tells me it's not a valid capture filter, and i should use a display filter - any ideas?
    – Hippyjim
    Jul 5, 2013 at 13:13
2

You can also use a capture filter to filter out the udp packets:
not udp port 1900

You can find more information about capture filters in the Wireshark User's Guide or the Wireshark Wiki.

Improve this answer
2
  • This returns a syntax error message.
    – Jonas
    Feb 12, 2012 at 22:14
  • Did you use it a a display filter? This is a capture filter (not a display filter). You have to add it before you start capturing: Wireshark Capture | Options Add the capture and hit start. If you want to use Tshark to capture packets: $ tshark -i 4 -f "not udp port 1900" -w not_udp.pcap
    – user83205
    Feb 13, 2012 at 7:23
1 
tcp.port == 8080

    

Improve this answer
0

Use a display filter to filter out the udp packets:

not udp.port == 1900
!(udp.port == 1900)

You can find more information about display filters in the Wireshark User's Guide or the Wireshark Wiki.

Improve this answer
1
  • You can edit your other answer instead of posting another one.
    – Jonas
    Feb 13, 2012 at 7:34
0

If you are only interested in traffic on tcp/8080, a capture filter would be better choice.

capture filter: tcp port 8080

This will filter as the traffic is coming in vs loading all the traffic in wireshark and using a display filter to trim down the results.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .