2

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet capturing to only HTTP or maybe only HTTP on port 8080. How can I do this in Wireshark?

On File > Preferences... and under Protocols I have removed the 1900 port from HTTP and 8080 is already there.

I have typed http in the "Filter" textfield, but it doesn't seem to have any effect.

5 Answers 5

2

In the filter field enter tcp.port eq 8080

Ref.: Wireshark: Help -> Manual pages -" Wireshark Filter ...

As far as I know this is an alternate HTTP port in TCP only:

HTTP alternate (http_alt)—commonly used for Web proxy and caching server, or for running a Web server as a non-root user and Apache Tomcat in TCP only

Ref.: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Hope this help. Let us know. :)

1
  • This tells me it's not a valid capture filter, and i should use a display filter - any ideas?
    – Hippyjim
    Jul 5, 2013 at 13:13
2

You can also use a capture filter to filter out the udp packets:
not udp port 1900

You can find more information about capture filters in the Wireshark User's Guide or the Wireshark Wiki.

2
  • This returns a syntax error message.
    – Jonas
    Feb 12, 2012 at 22:14
  • Did you use it a a display filter? This is a capture filter (not a display filter). You have to add it before you start capturing: Wireshark Capture | Options Add the capture and hit start. If you want to use Tshark to capture packets: $ tshark -i 4 -f "not udp port 1900" -w not_udp.pcap
    – user83205
    Feb 13, 2012 at 7:23
1
tcp.port == 8080

    

0

Use a display filter to filter out the udp packets:

not udp.port == 1900
!(udp.port == 1900)

You can find more information about display filters in the Wireshark User's Guide or the Wireshark Wiki.

1
  • You can edit your other answer instead of posting another one.
    – Jonas
    Feb 13, 2012 at 7:34
0

If you are only interested in traffic on tcp/8080, a capture filter would be better choice.

capture filter: tcp port 8080

This will filter as the traffic is coming in vs loading all the traffic in wireshark and using a display filter to trim down the results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.