Ethereal-users: Re: [Ethereal-users] Problem applying Ethereal filter

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Wed, 14 Jul 2004 10:31:25 -0700
At 08:38 PM 7/13/2004, Jerome VanRooijen wrote:

I have created a capture of my network, which has various traffic going over
it. The majority of this is FTP, and I would like to filter this out after
the capture stage, but when I apply the filter 'tcp.port != 21', Ethereal
continues to display all packets captured.

Is there something that I am missing?
Yes. TCP packets have two ports, a source and a destination. tcp.port refers to both. 'tcp.port != 21' is equivalent to 'tcp.srcport != 21 or tcp.dstport != 21'. Since in FTP traffic one of the ports is normally not 21, your filter matches all TCP packets.
Try '! tcp.port == 21'. Using 'port' is useful when used with == but has this often unexpected side-effect with !=.