Which command filters a port?

`tcp.port equals 25` is valid Wireshark syntax but it displays (includes) port 25 traffic rather than filtering it out.

`tcp.port is 25` uses the keyword `is`, which is not valid Wireshark display filter syntax - the correct operators are `==` or `equals`.

`tcp.port != 25` can behave unexpectedly on multi-occurrence fields - a packet with source port 25 and destination port 80 would still match because the destination port occurrence satisfies `!= 25`, potentially showing packets that should be excluded.

The expression `!tcp.port==25` applies logical NOT to the entire match, excluding any packet where any occurrence of the tcp.port field equals 25. This is important because `tcp.port` is a multi-occurrence field (covering both source and destination); using `!` negation ensures true exclusion of port 25 traffic. Wireshark's documentation specifically warns that `!=` on multi-occurrence fields can yield unexpected results, making `!field==value` the preferred form.