Show only HTTP traffic in Wireshark

Question

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.

Solution 1

In the filter field, type http (lowercase!). Tested with WireShark Portable 1.10.7

Some basic filters

• !http shows all traffic which is NOT http
• ip.src != 196.168.1.1 shows traffic which is NOT from this IP source
• ip.dst == 196.168.1.1 shows traffic to this IP destination
• ip.addr == 196.168.1.1 shows all traffic which has the specific IP as source OR destination

Solution 2

To exclude SSDP/UDP: http && tcp

Credit: http://www.emtek.net.nz/blog/2013/03/17/wireshark-filter-http-only-exclude-ssdp-or-udp/

Comments

[sashoalm]

OK, it's working, but it shows both http and ssdp fields, which is strange. When I tried typing just "ssdp", it said no such protocol exists.

[sashoalm]

Version 1.8.2. Also, when I typed "tcp" for filter, it showed TCP, TLSv1.1 and HTTP fields.

[DTrump - not that one]

If you type "tcp" as the filter, it'll show all TCP traffic, whether it's HTTP running over TCP, SSL/TLS running over TCP, or something else running over TCP.

[Arnoud Buzing]

I have been trying to figure that one out for ages. Thanks!

[SuperUberDuper]

what if you only see protocol: 0x0800

[SuperUberDuper]

ie I want to filter by http and don't see it