How to limit packet capturing in Wireshark to only a specific protocol

network-protocolsportsprotocolsniffingwireshark

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet capturing to only HTTP or maybe only HTTP on port 8080. How can I do this in Wireshark?

On File > Preferences... and under Protocols I have removed the 1900 port from HTTP and 8080 is already there.

I have typed http in the "Filter" textfield, but it doesn't seem to have any effect.

Best Answer

In the filter field enter tcp.port eq 8080

Ref.: Wireshark: Help -> Manual pages -" Wireshark Filter ...

As far as I know this is an alternate HTTP port in TCP only:

HTTP alternate (http_alt)—commonly used for Web proxy and caching server, or for running a Web server as a non-root user and Apache Tomcat in TCP only

Ref.: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Hope this help. Let us know. :)

Related Solutions

Macos – Usefulness of packets in wireshark? SSDP protocol, rather than HTTP

... all of the HTTP traffic is coming through as the SSDP protocol ...

Nope, all of your HTTP traffic is still coming over traditional TCP. You are just being flooded with SSDP packets and unable to separate these from real HTTP packets.

Easiest way to filter the "real" HTTP traffic is to type in to the Wireshark filter box:

http && tcp

And likewise if you wish to view (mostly) SSDP HTTP packets use this for filtering:

http && udp

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

If you are not connected via ethernet to you home router, most likely that home router than the home router uses a switch for its LAN ports and not a hub, thus each port has its own collision domain, whereas in a hub the collision domain is shared among all the ports and you would see all traffic on every port.

If you are connected wirelessly, there may be a few issues. First, certain wireless cards' drivers do not support being put into promiscous mode. Nothing can be done about that unless you want to write your own. Second, if your network is encrypted and you are only seeing layer 2 traffic from various sources and not the higher layer protocols expected (which doesn't appear to be the case), then you must enter the WEP key into wireshark so it can handle the decryption. WPA and WPA2 decryption get more complicated, as older versions of wireshark do not support it, and if it is supported, then you must capture the entire handshake taking place between the router and the device (EAPOL packets), as unique keys are generated between the device and router.

Best Answer

Related Solutions

Macos – Usefulness of packets in wireshark? SSDP protocol, rather than HTTP

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

Related Question