Home / server / Questions / 686595
Accepted
MacGyver
Asked: 2015-04-30 13:45:07 +0800 CST

How can the SSDP protocol be filtered out of Wireshark view?

  • 772

In Wireshark version 1.12.4, I am trying to filter out packet messages with an SSDP protocol. When I clicked the Expression button next to the Filter field, and selected "HTTP" (as Field Name) and "is present" (as Relation), I still get SSDP. Most of the messages are SSDP, so it's difficult to troubleshoot request and response packets I care about with SSDP in the list.

https://www.wireshark.org/download.html

wireshark

4 Answers

  1. Best Answer

    SSDP is implemented as a protocol that runs on top of HTTP-over-UDP, so the filter "http" will match SSDP packets. The filter "http and not udp" should eliminate SSDP packets; it will also, obviously, eliminate other HTTP-over-UDP packets, but I'm not sure there will ever be any HTTP-over-UDP packets that aren't SSDP packets.

    • 9

  2. I just used the functionality in the tool, by right clicking one of the packets that was problematic, then selected the sub-menu "Apply as Filter" > then selected ".. and not Selected" (under the "Not Selected" grouping).

    It then changed the expression to look like this.

    (http) && !(ip.dst == 239.255.255.250)

    So with using the Expression popup, it can only apply a single filter, but to get multiple filters, you can either type the filter expression, and click "Apply". Or use the right click context menu, click "Apply as Filter" and click "Apply".

    This eliminated all but 4 lines in the list! These all had the SSDP protocol.

    EDIT:

    Also, it appears Wireshark has it's own Q&A.

    https://ask.wireshark.org/questions/unanswered/

    • 4

  3. As Guy Harris's helpful answer suggests, SSDP is HTTP using UDP for transport, which means it can be succinctly caught by: 

    (!(http && udp))

    which makes it easy to continue filtering like:

    (!(http && udp)) & !ntp & ip.src==192.168.1.1

    in my case, SSDP was being used by a Sony Blu-Ray player for advertisement, so I could filter it out with:

    (!(http && udp && ip.dst==239.255.255.250))
    • 1

  4. I tried http and !udp and it didn't work. However I found the following works for me:

    http and !(ip.addr == 192.168.0.253 or ip.addr==239.255.255.250 or ipv6.addr == ff02::c)

    192.168.0.253 is my router's IP.

    • 0