Ethereal-dev: Re: [Fwd: Re: [Ethereal-dev] Filter expressions for exclusion]

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Tue, 31 Dec 2002 15:42:57 -0800 (PST)
John McDermott said:
> OK.  So this got me to thinking.  How do I write "I want to see all
> packets except HTTP packets".  The answer is '!tcp.port == 80'.

Actually, the answer is "!http" - there is no guarantee that HTTP traffic
appears only on port 80, and Ethereal also supports some other ports as
HTTP ports, e.g. 8080 (common alternate HTTP port), 3128 (common HTTP
proxy port), 3132 (HTTP proxy admin port, at least for proxies made by a
certain manufacturer of, well, network appliances), both TCP *and* UDP
ports 1900 (for the Simple Service Discovery Protocol, which I think is
part of Microsoft's UPnP, and that runs atop HTTP), and TCP port 631 (for
the Internet Printing Protocol, which also runs atop HTTP).