Hi all,
I have two packets with src port == 8080 and dst port == 6006 (which is x11) and when applying the display filter of 'http' I do not see those packets. Port 8080 is configured for http in the protocol preferences. The packets simply show as tcp. Only if I add port 6006 to http preferences I am able to see the packet when filtering - but that is not a solution for me.
Can anyone help/advise?
Can you put a script wrapper around Wireshark and specify the port at startup?
https://www.wireshark.org/docs/man-pa...
-d <layer type>==<selector>,<decode-as protocol>
Like Wireshark's Decode As... feature, this lets you specify how a layer type should be dissected. If the layer type in question (for example, tcp.port or udp.port for a TCP or UDP port number) has the specified selector value, packets should be dissected as the specified protocol.
Example: -d tcp.port==8888,http will decode any traffic running over TCP port 8888 as HTTP.
See the tshark(1) manual page for more examples.
Comments