!ssh works in wireshark but not in tshark!,
When I do
tshark '!ssh', it complains about the filter, so what's wrong here?
When I do
Similar effect with capture filters:
Please note, that tshark has default capture filters if you run it over ssh.
Like @jofel said in his answer and as I explain in details in my wireshark tutorial for beginners - there is a difference between display filters and capture filters.
On a very crowded network capturing every packet could produce gigabytes of data in just few seconds and most probably a lot of it is not interesting to you at all.
This is where capture filters come handy. By defining capture filter you can tell Wireshark to capture only some subset of network traffic. You can filter by IP addresses, IP address range, port numbers, protocol and so on.
Please take a note that when you use a capture filter, the packets that are not matching will not be saved to the capture file. You will never be able to recover them. If your network is not very crowded it’s usually better idea to capture and save everything and then use display filters to analyse only the subset that is interesting.
Here's the documentation for capture filter syntax
Display filters** is another story
Display filters are different from capture filters. They limit only what you see at the moment in the wireshark interface (or tshark output to the console) - are much more advanced and use a different syntax. You can use most of the packet fields recognised by the dissectors with various operators - comparing strings, checking values and so on.
What you type in the Wireshark GUI toolbar is the display filter. I highly recommend playing around with the "expressions" window next to it. It's one of the most important and most often used wireshark features.
The reason you cant use "not ssh" capture filter is that capture filters work on lower level than display filters. Wireshark does not "know" yet what protocol it is for each packet when it performs capture filtering. It's higher level analysis performed by dissectors.
To filter everything except the SSH traffic on the capture level you have to filter port 22 traffic ie with
If it comes to tshark
You can use both capture filters and display filters with tshark but they are different command line switch options:
capture filter example:
display filter example:
Another thing is that you used
Hope that's exhaustive answer and it justifies my shameless plug on the beginning :)