Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do:

tcp.dstport != 3389 && tcp.srcport != 3389

It would implicate TCP packets only, what should the syntax be like?

share|improve this question
    
can you clarify what do you want to show and what you do not –  Salvador Dali Nov 28 '12 at 2:22
    
A bit late to comment, but why are you asking this on a security site? –  AviD Aug 27 '13 at 12:34
    
This question does not appear to be about IT security within the scope defined in the help center. –  AviD Aug 27 '13 at 12:35
add comment

closed as off-topic by AviD Aug 27 '13 at 12:35

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 2 down vote accepted

The Whole != thing doesn't work very well. If you notice your expression filter text area is yellow when you do that.

Try this instead.

!(tcp.dstport == 3389) && !(tcp.srcport == 3389)

I recommend reading the wireshark user guide. Section 6.4.4 specifically references the problem you had.

User Guide -- Filter Section

share|improve this answer
add comment

Use tcp.port to compress condition:

!tcp.port==3389

tcp.port means source port or destination port.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.