26

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.

enter image description here

  • 1
    HTTP traffic usually IS TCP traffic; it's not as if HTTP and TCP are at the same network layer. The Protocol column just shows the topmost protocol layer Wireshark understands; if a TCP packet just has an ACK and no data, or Wireshark doesn't know how to dissect the data, it'll show it as TCP, but if it does know how to dissect it, it'll show that protocol. – user164970 May 2 '14 at 21:41
34

In the filter field, type http (lowercase!). Tested with WireShark Portable 1.10.7

enter image description here

Some basic filters

  • !http shows all traffic which is NOT http
  • ip.src != 196.168.1.1 shows traffic which is NOT from this IP source
  • ip.dst == 196.168.1.1 shows traffic to this IP destination
  • ip.addr == 196.168.1.1 shows all traffic which has the specific IP as source OR destination
| improve this answer | |
  • 1
    OK, it's working, but it shows both http and ssdp fields, which is strange. When I tried typing just "ssdp", it said no such protocol exists. – sashoalm May 1 '14 at 23:03
  • What wireshark version do you use? The wireshark wiki says, that you cannot filter for SSDP. Workaround is udp.dstport == 1900 && http – nixda May 1 '14 at 23:03
  • Version 1.8.2. Also, when I typed "tcp" for filter, it showed TCP, TLSv1.1 and HTTP fields. – sashoalm May 1 '14 at 23:07
  • If you type "tcp" as the filter, it'll show all TCP traffic, whether it's HTTP running over TCP, SSL/TLS running over TCP, or something else running over TCP. – user164970 May 2 '14 at 21:42
  • what if you only see protocol: 0x0800 – SuperUberDuper Sep 17 '19 at 11:55
5

To exclude SSDP/UDP: http && tcp

Credit: http://www.emtek.net.nz/blog/2013/03/17/wireshark-filter-http-only-exclude-ssdp-or-udp/

| improve this answer | |
  • I have been trying to figure that one out for ages. Thanks! – Arnoud Buzing Apr 7 '15 at 20:10
1

If you want to filter "ip address" and e.g. "http protocol" you have to input:

ip.src==192.168.109.217&&http

without spaces between.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.