210-255 · Question #96
Filtering ports in wireshark?
The correct answer is A. tcp.port == 80. Wireshark display filters use dot-notation field names with explicit comparison operators to filter traffic. Only the correctly structured expression will be accepted by the Wireshark display filter engine.
Question
Filtering ports in wireshark?
Options
- Atcp.port == 80
- Btcp port equals 80
- Ctcp.port 80
- Dport 80
How the community answered
(15 responses)- A93% (14)
- B7% (1)
Why each option
Wireshark display filters use dot-notation field names with explicit comparison operators to filter traffic. Only the correctly structured expression will be accepted by the Wireshark display filter engine.
tcp.port == 80 is the correct Wireshark display filter syntax - it uses the dot-notation field name 'tcp.port' with the mandatory equality operator '==' and an integer value, matching all TCP packets where either the source or destination port is 80.
tcp port equals 80 is not valid Wireshark display filter syntax because Wireshark does not accept plain English keywords like 'equals' and omits the required dot-notation field separator, making this expression unparseable by the display filter engine.
tcp.port 80 is invalid because it omits the required comparison operator '==' between the field name and the value; Wireshark display filters require an explicit operator and will return a parse error without one.
port 80 is a BPF (Berkeley Packet Filter) capture filter expression used in the capture filter field, not a valid Wireshark display filter - the display filter bar requires the full field-qualified form 'tcp.port == 80' with dot-notation and a comparison operator.
Concept tested: Wireshark display filter syntax for TCP port filtering
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
Topics
Community Discussion
No community discussion yet for this question.