What about: tcp.port==22 Normally an SSH Server/Service/Daemon listens on TCP Port 22.
If the SSH end point is on a different port, then you can filter on the server port (e.g. tcp.port==60022) and right click on a packet and select decode as, and choose SSH. Hope this helps, --Jim > -----Original Message----- > Hi all, > > Can anybody tell me how can I capture packets which belong to SSH > connection? When I establish a SSH connection, even all SSH packets are > shown as TCP packets however I have set the filter to capture all packets. > _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
