How do I limit packet capturing in Wireshark to only a specific protocol?

Question

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet capturing to only HTTP or maybe only HTTP on port 8080. How can I do this in Wireshark?

On File > Preferences... and under Protocols I have removed the 1900 port from HTTP and 8080 is already there.

I have typed http in the "Filter" textfield, but it doesn't seem to have any effect.

Answer 1

In the filter field enter tcp.port eq 8080

Ref.: Wireshark: Help -> Manual pages -" Wireshark Filter ...

As far as I know this is an alternate HTTP port in TCP only:

HTTP alternate (http_alt)—commonly used for Web proxy and caching server, or for running a Web server as a non-root user and Apache Tomcat in TCP only

Ref.: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Hope this help. Let us know. :)

Answer 2

You can also use a capture filter to filter out the udp packets:
not udp port 1900

You can find more information about capture filters in the Wireshark User's Guide or the Wireshark Wiki.

Answer 3

tcp.port == 8080

    

Answer 4

Use a display filter to filter out the udp packets:

not udp.port == 1900
!(udp.port == 1900)

You can find more information about display filters in the Wireshark User's Guide or the Wireshark Wiki.