Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The filter !ssh works in wireshark but not in tshark!,

When I do tshark '!ssh', it complains about the filter, so what's wrong here?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

There is a difference between the simpler capture filters and the more powerful display filters.

!ssh is a display filter. You can use it with tshark like

tshark -R '!ssh'

Similar effect with capture filters:

tshark 'not tcp port 22'

Please note, that tshark has default capture filters if you run it over ssh.

share|improve this answer
+1 for capture filter and display filters! never heard of, thanks! –  warl0ck Dec 30 '12 at 13:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.