Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do:

tcp.dstport != 3389 && tcp.srcport != 3389

It would implicate TCP packets only, what should the syntax be like?

share|improve this question

closed as off-topic by AviD Aug 27 '13 at 12:35

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

can you clarify what do you want to show and what you do not – Salvador Dali Nov 28 '12 at 2:22
A bit late to comment, but why are you asking this on a security site? – AviD Aug 27 '13 at 12:34
This question does not appear to be about IT security within the scope defined in the help center. – AviD Aug 27 '13 at 12:35
up vote 2 down vote accepted

The Whole != thing doesn't work very well. If you notice your expression filter text area is yellow when you do that.

Try this instead.

!(tcp.dstport == 3389) && !(tcp.srcport == 3389)

I recommend reading the wireshark user guide. Section 6.4.4 specifically references the problem you had.

User Guide -- Filter Section

share|improve this answer

Use tcp.port to compress condition:


tcp.port means source port or destination port.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.