Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet capturing to only HTTP or maybe only HTTP on port 8080. How can I do this in Wireshark?

On File > Preferences... and under Protocols I have removed the 1900 port from HTTP and 8080 is already there.

I have typed http in the "Filter" textfield, but it doesn't seem to have any effect.

share|improve this question

5 Answers 5

up vote 1 down vote accepted

In the filter field enter tcp.port eq 8080

Ref.: Wireshark: Help -> Manual pages -" Wireshark Filter ...

As far as I know this is an alternate HTTP port in TCP only:

HTTP alternate (http_alt)—commonly used for Web proxy and caching server, or for running a Web server as a non-root user and Apache Tomcat in TCP only

Ref.: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Hope this help. Let us know. :)

share|improve this answer
    
This tells me it's not a valid capture filter, and i should use a display filter - any ideas? –  Hippyjim Jul 5 '13 at 13:13

You can also use a capture filter to filter out the udp packets:
not udp port 1900

You can find more information about capture filters in the Wireshark User's Guide or the Wireshark Wiki.

share|improve this answer
    
This returns a syntax error message. –  Jonas Feb 12 '12 at 22:14
    
Did you use it a a display filter? This is a capture filter (not a display filter). You have to add it before you start capturing: Wireshark Capture | Options Add the capture and hit start. If you want to use Tshark to capture packets: $ tshark -i 4 -f "not udp port 1900" -w not_udp.pcap –  joke Feb 13 '12 at 7:23
tcp.port == 8080

    

share|improve this answer

Use a display filter to filter out the udp packets:

not udp.port == 1900
!(udp.port == 1900)

You can find more information about display filters in the Wireshark User's Guide or the Wireshark Wiki.

share|improve this answer
    
You can edit your other answer instead of posting another one. –  Jonas Feb 13 '12 at 7:34

If you are only interested in traffic on tcp/8080, a capture filter would be better choice.

capture filter: tcp port 8080

This will filter as the traffic is coming in vs loading all the traffic in wireshark and using a display filter to trim down the results.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.