pcap filter

今天用tshark抓包，本以为wireshark能用的filter，如“mysql”它也应该能用，其实不然；
tshark -f只认识pcap filter，用-R的话，说要用-2，加上-2的话又说什么我忘了，直接用pcap filter吧。

http://yuba.stanford.edu/~casado/pcap/section3.html

http://blog.sina.com.cn/s/blog_6cb117430100lz7q.html

Both tshark and tcpdump use the pcap library, so the capture filters use pcap-filter syntax. The filter you want is, as @tristan says, "not port 22". You can enter this as a quoted string argument to the -f option, or as an unquoted argument to the command. The following commands are equivalent:

# tshark -f "not port 22"
# tshark -- not port 22

The reason tshark complained about your command above is that your shell (probably Bash) expanded "!22" to command number 22 in your command history, which in this case was "ls". The Bash documentation has more information on history expansion.