How can the SSDP protocol be filtered out of Wireshark view?

Question

In Wireshark version 1.12.4, I am trying to filter out packet messages with an SSDP protocol. When I clicked the Expression button next to the Filter field, and selected "HTTP" (as Field Name) and "is present" (as Relation), I still get SSDP. Most of the messages are SSDP, so it's difficult to troubleshoot request and response packets I care about with SSDP in the list.

https://www.wireshark.org/download.html

Solution 1

SSDP is implemented as a protocol that runs on top of HTTP-over-UDP, so the filter "http" will match SSDP packets. The filter "http and not udp" should eliminate SSDP packets; it will also, obviously, eliminate other HTTP-over-UDP packets, but I'm not sure there will ever be any HTTP-over-UDP packets that aren't SSDP packets.

Solution 2

I just used the functionality in the tool, by right clicking one of the packets that was problematic, then selected the sub-menu "Apply as Filter" > then selected ".. and not Selected" (under the "Not Selected" grouping).

It then changed the expression to look like this.

(http) && !(ip.dst == 239.255.255.250)

So with using the Expression popup, it can only apply a single filter, but to get multiple filters, you can either type the filter expression, and click "Apply". Or use the right click context menu, click "Apply as Filter" and click "Apply".

This eliminated all but 4 lines in the list! These all had the SSDP protocol.

EDIT:

Also, it appears Wireshark has it's own Q&A.

https://ask.wireshark.org/questions/unanswered/

Solution 3

As Guy Harris's helpful answer suggests, SSDP is HTTP using UDP for transport, which means it can be succinctly caught by:

(!(http && udp))

which makes it easy to continue filtering like:

(!(http && udp)) & !ntp & ip.src==192.168.1.1

in my case, SSDP was being used by a Sony Blu-Ray player for advertisement, so I could filter it out with:

(!(http && udp && ip.dst==239.255.255.250))

Comments

[MacGyver]

krisFR - Yes, I am best with toothpicks. :-)

[MacGyver]

krisFR - Yah, I figured nobody would care about the destination IP. So I explained how I did it. That should be more useful for readers who aren't MacGyver. ;-)

[MacGyver]

en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol

[MacGyver]

This worked for me: http && !udp .... it filtered out the same packets as my answer, but this seems more realistic.

[MacGyver]

Actually, I found this link. Maybe the IP address is always the same. 239.255.255.250. wiki.wireshark.org/SSDP I'm on Windows 7.

[Admin]

That's not surprising, given that http and not udp and http && !udp are the exact same filter.