In Wireshark version 1.12.4, I am trying to filter out packet messages with an SSDP protocol. When I clicked the Expression button next to the Filter field, and selected "HTTP" (as Field Name) and "is present" (as Relation), I still get SSDP. Most of the messages are SSDP, so it's difficult to troubleshoot request and response packets I care about with SSDP in the list.
asked Apr 29, 2015 at 21:45
-
1krisFR - Yes, I am best with toothpicks. :-)– JustBeingHelpfulApr 29, 2015 at 22:33
-
krisFR - Yah, I figured nobody would care about the destination IP. So I explained how I did it. That should be more useful for readers who aren't MacGyver. ;-)– JustBeingHelpfulApr 29, 2015 at 22:34
-
en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol– JustBeingHelpfulApr 29, 2015 at 23:08
Add a comment
|
4 Answers
SSDP is implemented as a protocol that runs on top of HTTP-over-UDP, so the filter "http" will match SSDP packets. The filter "http and not udp" should eliminate SSDP packets; it will also, obviously, eliminate other HTTP-over-UDP packets, but I'm not sure there will ever be any HTTP-over-UDP packets that aren't SSDP packets.
-
1This worked for me: http && !udp .... it filtered out the same packets as my answer, but this seems more realistic. Apr 30, 2015 at 21:20
-
Actually, I found this link. Maybe the IP address is always the same. 239.255.255.250. wiki.wireshark.org/SSDP I'm on Windows 7. Apr 30, 2015 at 21:34
-
That's not surprising, given that
http and not udpandhttp && !udpare the exact same filter.– user137177Apr 30, 2015 at 23:54
I just used the functionality in the tool, by right clicking one of the packets that was problematic, then selected the sub-menu "Apply as Filter" > then selected ".. and not Selected" (under the "Not Selected" grouping).
It then changed the expression to look like this.
(http) && !(ip.dst == 239.255.255.250)
So with using the Expression popup, it can only apply a single filter, but to get multiple filters, you can either type the filter expression, and click "Apply". Or use the right click context menu, click "Apply as Filter" and click "Apply".
This eliminated all but 4 lines in the list! These all had the SSDP protocol.
EDIT:
Also, it appears Wireshark has it's own Q&A.
answered Apr 29, 2015 at 22:30
As Guy Harris's helpful answer suggests, SSDP is HTTP using UDP for transport, which means it can be succinctly caught by:
(!(http && udp))
which makes it easy to continue filtering like:
(!(http && udp)) & !ntp & ip.src==192.168.1.1
in my case, SSDP was being used by a Sony Blu-Ray player for advertisement, so I could filter it out with:
(!(http && udp && ip.dst==239.255.255.250))
answered Oct 22, 2015 at 3:38
89c3b1b8-b1ae-11e6-b842-48d70589c3b1b8-b1ae-11e6-b842-48d705
1,4651 gold badge13 silver badges22 bronze badges
I tried http and !udp and it didn't work. However I found the following works for me:
http and !(ip.addr == 192.168.0.253 or ip.addr==239.255.255.250 or ipv6.addr == ff02::c)
192.168.0.253 is my router's IP.
