This is our old Q&A Site. Please post any new questions and answers at

I'm having a devil of a time discovering an expression for displaying only packets which have come to from one particular port using any protocol. Any help?

asked 07 Dec '13, 11:12

JourneyJay's gravatar image

accept rate: 0%

A port is generally associated with tcp or udp so tcp.port == xxx || udp.port == xxx


As the user seems to really mean all protocols that have a notion of a "port", then the answer is not really. The Wireshark display filters refer to fields within a container (such as a protocol) so you would have to enumerate all possible containers that have a field corresponding to the notion of a port (and in same it may not be named as such). There is no "global" field named port such that all dissectors would match their internal notion of a port to the global one.

permanent link

answered 07 Dec '13, 12:45

grahamb's gravatar image

grahamb ♦
accept rate: 22%

edited 08 Dec '13, 05:07

These aren't the only options.

(07 Dec '13, 17:17) JourneyJay

Yes, there's also the SCTP port.

There are, however, many many many protocols that don't have "ports" in the sense of a TCP or UDP or SCTP port. If that's the sense in which you meant port, there obviously does not exist, and obviously cannot ever exist, "packets which have come to from one particular port using any protocol", as "any protocol" includes protocols that have no notion of a "port".

(07 Dec '13, 18:09) Guy Harris ♦♦

@JouneyJay: Could you please add more information? What are you trying to find with such a filter?

(08 Dec '13, 10:13) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 07 Dec '13, 11:12

question was seen: 2,000 times

last updated: 08 Dec '13, 10:13

p​o​w​e​r​e​d by O​S​Q​A