WireShark: How do i use “Apply as filter”?

Question

i'm seeing some packets in WireShark that i don't want to see:

No problem, right-click on SSDP and click

• Apply as Filter
  • ...and not Selected

Except i've never been able to get the Appy as Filter menu to accomplish anything:

Except there's nothing to expand, and i've never been able to select any item that doesn't show that error.

So how do i use "Apply as Filter"?

Answer 1

Instead of doing it at that level use the window below, where the detail of the packet is. Open the level that corresponds to the level you want to apply, SSDP is part of the HTTP session, so you'll want to open the HTTP portion at the bottom. Look for the SSDP reference there, then right-click and choose "Not Selected".

Use "and" or "or" options for adding to the filter. You can see the filter contructed int the Filter bar at the top to make sure it is doing what you expect (and you can add parenthesis if it isn't doing the logic right).