can you capture TCP and UDP packets on port 80? i saw the filter command tcp.port == 80 || udp.port == 80 but thats just an or so i changed it to "and" with tcp.port == 80 && udp.port == 80 but that didnt do much of anything. any help would be nice thank you asked 29 Feb '16, 13:55  cadel546 |
2 Answers:
You original display filter was correct. With both the capture and display filters you are specifying what packets you want to see/capture. With the display filter "tcp.port == 80 || udp.port == 80" you are looking for packets which are TCP or UDP ports 80. With the display filter "tcp.port == 80 && udp.port == 80" you are looking for traffic which is TCP and UDP port 80 however a packet cannot be both TCP and UDP at the same time (without complicated encapsulation that's out of scope of this thread anyway). Luke answered 29 Feb '16, 16:21  sludge3000 |
Those filters are display filters. If you are trying to filter during a capture, you need to provide the correct filter: port 80 If you want to filter all HTTP traffic, then it would be port 80 or port 8080 answered 29 Feb '16, 14:34  Amato_C Yeah I forgot to mention that just display filters is fine. But even when I write udp && TCP in the display filter is not showing anything so I'm wondering if there's anything wrong with my wireshark installation or something (29 Feb '16, 14:40) cadel546 I was thinking because you can only listen to one thing at a time on the same port?? Yeah..I don't really know (29 Feb '16, 15:18) cadel546 |
That's what I needed to know. I had an idea but I wasn't sure thank you so much