26

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.

enter image description here

1
  • 1
    HTTP traffic usually IS TCP traffic; it's not as if HTTP and TCP are at the same network layer. The Protocol column just shows the topmost protocol layer Wireshark understands; if a TCP packet just has an ACK and no data, or Wireshark doesn't know how to dissect the data, it'll show it as TCP, but if it does know how to dissect it, it'll show that protocol.
    – user164970
    May 2, 2014 at 21:41

3 Answers 3

34

In the filter field, type http (lowercase!). Tested with WireShark Portable 1.10.7

enter image description here

Some basic filters

  • !http shows all traffic which is NOT http
  • ip.src != 196.168.1.1 shows traffic which is NOT from this IP source
  • ip.dst == 196.168.1.1 shows traffic to this IP destination
  • ip.addr == 196.168.1.1 shows all traffic which has the specific IP as source OR destination
6
  • 1
    OK, it's working, but it shows both http and ssdp fields, which is strange. When I tried typing just "ssdp", it said no such protocol exists.
    – sashoalm
    May 1, 2014 at 23:03
  • What wireshark version do you use? The wireshark wiki says, that you cannot filter for SSDP. Workaround is udp.dstport == 1900 && http
    – nixda
    May 1, 2014 at 23:03
  • Version 1.8.2. Also, when I typed "tcp" for filter, it showed TCP, TLSv1.1 and HTTP fields.
    – sashoalm
    May 1, 2014 at 23:07
  • If you type "tcp" as the filter, it'll show all TCP traffic, whether it's HTTP running over TCP, SSL/TLS running over TCP, or something else running over TCP.
    – user164970
    May 2, 2014 at 21:42
  • what if you only see protocol: 0x0800 Sep 17, 2019 at 11:55
5

To exclude SSDP/UDP: http && tcp

Credit: http://www.emtek.net.nz/blog/2013/03/17/wireshark-filter-http-only-exclude-ssdp-or-udp/

1
  • I have been trying to figure that one out for ages. Thanks! Apr 7, 2015 at 20:10
1

If you want to filter "ip address" and e.g. "http protocol" you have to input:

ip.src==192.168.109.217&&http

without spaces between.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .