I am trying to monitor behaviour of packets from my PC -> VirtualBox machine which represents a virtual router, and I have established SSH session to it.

My question is, how to filter out all SSH traffic from displaying and monitor other protocols ?

So far, the filter that I am using:

ip.addr == && tcp.port != 22 && not ssh

is showing me ACK packets, and somehow it isn't "filtered" completely.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 17:51

The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them.

How about simply using

ip.addr == && tcp.port != 22
  • Here are your results : imgur.com/a/NzexM .Maybe I wasn't clear, but I don't want to see any client->server ssh communication. – fugitive Jan 13 '17 at 15:14
  • 2
    It's almost there: ip.addr == && !(tcp.port == 22) – Jaap Keuter Jan 13 '17 at 15:18
  • @JaapKeuter Perfect. This is what I needed. Thanks. – fugitive Jan 13 '17 at 15:34
  • 1
    Nice. For more info why this works, read this part[1] of the manual. [1]: wireshark.org/docs/wsug_html_chunked/… – Jaap Keuter Jan 13 '17 at 16:38
  • @JaapKeuter Thanks man. Much appreciated. :-) – fugitive Jan 13 '17 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.