Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i'm seeing some packets in WireShark that i don't want to see:

enter image description here

No problem, right-click on SSDP and click

  • Apply as Filter
    • ...and not Selected

enter image description here

Except i've never been able to get the Appy as Filter menu to accomplish anything:

enter image description here

Except there's nothing to expand, and i've never been able to select any item that doesn't show that error.

So how do i use "Apply as Filter"?

share|improve this question
up vote 2 down vote accepted

Instead of doing it at that level use the window below, where the detail of the packet is. Open the level that corresponds to the level you want to apply, SSDP is part of the HTTP session, so you'll want to open the HTTP portion at the bottom. Look for the SSDP reference there, then right-click and choose "Not Selected".

Use "and" or "or" options for adding to the filter. You can see the filter contructed int the Filter bar at the top to make sure it is doing what you expect (and you can add parenthesis if it isn't doing the logic right).

share|improve this answer
That works. But it begs the question: what is the purpose of those context menu options in the top listview? Why are they there if they cannot be used there? – Ian Boyd Nov 10 '11 at 13:27
Yeah it does, my guess would be a bug or oversight – Paul Nov 10 '11 at 20:53

From what I've seen the context menu isn't valid for the protocol column. Right clicking on other columns such as Source, Destination, Length, etc will give the expected result. In troubleshooting, you may want to use the "Prepare as Filter", which will add the filter text to the dialog above but not apply it immediately. That way you can review what wireshark thinks you're trying to accomplish.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .