Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I understood everything that relies on TCP).

So my next try was tcp && !http && !ssl which is working correctly. But for sure can show some other protocols that rely on tcp and not included in my ! list.

What is the right way of restricting only to TCP?

Thanks David Schwartz, I really meant packets. The thing, I wanted to achieve - is only to display packets from TCP protocol.

May be I am really not able to express myself. I will try one more time using a picture. enter image description here

Here is my filter tcp and in the column protocol see tls and something else. I do not want this to happen. So when I am using tcp && !http && !ssl it solves my problem, but can is there anything better?

share|improve this question
would it be tcp && (!=http | !=ssl) – SpacemanSpiff Dec 21 '12 at 17:11
First, I think you mean "packets", not packages. Second, HTTP packets are TCP packets. It would help if you could more precisely state what it is you want. – David Schwartz Dec 21 '12 at 17:13
@SpacemanSpiff: That wouldn't filter anything out. Everything is either not HTTP or not SSL. (If it's HTTP, it's not SSL. If it's SSL, it's not HTTP. If it's neither HTTP nor SSL, it's not HTTP. So that test would allow every packet.) – David Schwartz Dec 21 '12 at 17:14
too much coffee and no sleep... why not filter the CAPTURE on TCP only... then filter out HTTP and HTTPS traffic using a display filter – SpacemanSpiff Dec 21 '12 at 17:16
What do you expect to see differently in Wireshark? Just the TCP packets for a specific application? If so, you'll need to know the port number it is communicating on and filter on that -- tcp.port eq 10000 – jimbobmcgee Dec 21 '12 at 19:40
up vote 3 down vote accepted

As others mentioned, all these protocols are TCP. You can try ! which excludes packets with payloads, but even that is not 100% it seems. What are you trying to find? Just TCP handshakes? Perhaps there is a better solution if you can tell us what exactly you're looking for. With the filters you have been using, you are excluding SYN and ACKs so I'm assuming you're not looking for them. What's left? TCP is just a transport for higher level protocols, it doesn't really do anything by itself.

share|improve this answer

Use the built in capture filter to capture only TCP traffic.

share|improve this answer
so this is basically the same thing, as I mentioned, because I can not see the difference between: tcp && !http && !ssl and tcp && !(http or ssl) – Salvador Dali Dec 21 '12 at 17:21
Did you try, i don't know, playing with it? – SpacemanSpiff Dec 21 '12 at 17:22
David is quite right here, my regex skills suck for sure. – SpacemanSpiff Dec 21 '12 at 17:29
I tried and if just to open up boolean expression, you will see that – Salvador Dali Dec 21 '12 at 17:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.