2

I am trying to monitor behaviour of packets from my PC -> VirtualBox machine which represents a virtual router, and I have established SSH session to it.

My question is, how to filter out all SSH traffic from displaying and monitor other protocols ?

So far, the filter that I am using:

ip.addr == 10.0.0.31 && tcp.port != 22 && not ssh

is showing me ACK packets, and somehow it isn't "filtered" completely.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 17:51
4

The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them.

How about simply using

ip.addr == 10.0.0.31 && tcp.port != 22
5
  • Here are your results : imgur.com/a/NzexM .Maybe I wasn't clear, but I don't want to see any client->server ssh communication.
    – fugitive
    Jan 13 '17 at 15:14
  • 3
    It's almost there: ip.addr == 10.0.0.31 && !(tcp.port == 22) Jan 13 '17 at 15:18
  • @JaapKeuter Perfect. This is what I needed. Thanks.
    – fugitive
    Jan 13 '17 at 15:34
  • 1
    Nice. For more info why this works, read this part[1] of the manual. [1]: wireshark.org/docs/wsug_html_chunked/… Jan 13 '17 at 16:38
  • @JaapKeuter Thanks man. Much appreciated. :-)
    – fugitive
    Jan 13 '17 at 17:29
0
ip.src==155.85.79.321 && !(tcp.port == 22) && !ssh

Exclude a port

!(tcp.port == 22)

The last no ssh can not be needed!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.