up vote 2 down vote favorite
share [g+] share [fb]

What I need to see is the TCP messages sent to a port for a given IP. So for example

127.0.0.1:11000

How can I see all the TCP messages being sent to that port?

This has to work with Windows, either Windows 2003 or XP

I have tried WireShark, but I don't know the proper filter.

The soluiton does not have to wireshark, but the solution must cost nothing.

link|improve this question
100% accept rate
feedback

3 Answers

up vote 3 down vote accepted

The filter language for Wireshark is taken from tcpdump/pcap-filter. Please click on the link for a reference.

So, for example, to filter on all messages with destination 127.0.0.1:11000 you would use the following expression: tcp port 11000 and dest host 127.0.0.1.

link|improve this answer
Note that there are two types of filters: capture filters, and display filters. I've provided the capture filter (which limits what packets are captured). @quadruplebucky has provided a display filter which you could apply after capturing all packets. – PP. Feb 26 '10 at 15:28
That filter should also work with windump, the windows version of tcpdump – charlesbridge Feb 26 '10 at 19:53
feedback
up vote 1 down vote

Wireshark traffic filters are explained here : http://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html

Basically in your case, you need

tcp port 11000 and host localhost
link|improve this answer
feedback
up vote 1 down vote

The wireshark expression is ip.addr == 127.0.0.1 and tcp.port == 11000

Also, you could use Microsoft Network Monitor 3.3, which might look a little more familiar. The display (or capture -- syntax is the same) filter for that would be: TCP.DstPort == 11000 and Ipv4.Address == 127.0.0.1

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.