The filter !ssh works in wireshark but not in tshark!,

When I do tshark '!ssh', it complains about the filter, so what's wrong here?


There is a difference between the simpler capture filters and the more powerful display filters.

!ssh is a display filter. You can use it with tshark like

tshark -R '!ssh'

Similar effect with capture filters:

tshark 'not tcp port 22'

Please note, that tshark has default capture filters if you run it over ssh.

  • +1 for capture filter and display filters! never heard of, thanks! – daisy Dec 30 '12 at 13:04

Like @jofel said in his answer and as I explain in details in my wireshark tutorial for beginners - there is a difference between display filters and capture filters.

Capture filters

On a very crowded network capturing every packet could produce gigabytes of data in just few seconds and most probably a lot of it is not interesting to you at all.

This is where capture filters come handy. By defining capture filter you can tell Wireshark to capture only some subset of network traffic. You can filter by IP addresses, IP address range, port numbers, protocol and so on.

Please take a note that when you use a capture filter, the packets that are not matching will not be saved to the capture file. You will never be able to recover them. If your network is not very crowded it’s usually better idea to capture and save everything and then use display filters to analyse only the subset that is interesting.

Here's the documentation for capture filter syntax

Display filters** is another story

Display filters are different from capture filters. They limit only what you see at the moment in the wireshark interface (or tshark output to the console) - are much more advanced and use a different syntax. You can use most of the packet fields recognised by the dissectors with various operators - comparing strings, checking values and so on.

What you type in the Wireshark GUI toolbar is the display filter. I highly recommend playing around with the "expressions" window next to it. It's one of the most important and most often used wireshark features.

The reason you cant use "not ssh" capture filter is that capture filters work on lower level than display filters. Wireshark does not "know" yet what protocol it is for each packet when it performs capture filtering. It's higher level analysis performed by dissectors.

To filter everything except the SSH traffic on the capture level you have to filter port 22 traffic ie with "not port 22" capture filter.

If it comes to tshark

You can use both capture filters and display filters with tshark but they are different command line switch options:

capture filter example: tshark -f "not port 22"

display filter example: tshark -R "not ssh"

Another thing is that you used !ssh while exclamation mark on some popular unix shells (like bash) has special meaning and is interpreted by shell before it's passed to the application you're about to execute. You should escape it like this \!ssh or simply use the not logical operator which is supported by both capture and display filters.

Hope that's exhaustive answer and it justifies my shameless plug on the beginning :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.