Is tshark using different syntax with wireshark?

Question

The filter !ssh works in wireshark but not in tshark!,

When I do tshark '!ssh', it complains about the filter, so what's wrong here?

Answer 1

There is a difference between the simpler capture filters and the more powerful display filters.

!ssh is a display filter. You can use it with tshark like

tshark -R '!ssh'

Similar effect with capture filters:

tshark 'not tcp port 22'

Please note, that tshark has default capture filters if you run it over ssh.