[Ulf Lamping <ulf.lamping@xxxxxx>]

David Drexler wrote:
> It's either to or from 'http'.  I also tried
>
> tcp.port != 80
>
> same results.  I want to run the capture realtime and only see the 
> traffic that interests me.
Your display filter falls under the "A common mistake", try !(tcp.port 
== 80) instead, which is not the same.

HTTP can be transported over various TCP ports - not only port 80.

See:

http://wiki.wireshark.org/Hyper_Text_Transfer_Protocol?action=show&redirect=HTTP 
for protocol info
http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html 
for capture filters and
http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html 
for display filters

Regards, ULFL