Microsoft Network Monitor Filter Sample

IPv4.DestinationAddress == 10.30.40.25// Filter frames by TCP port number.
and
tcp.port == 8080// This filter shows you all DNS traffic.  Any protocol
// can be filter by using the protocol name.  You can
// see a list of protocols by type "protocol." in the filter
// window.

and HTTP

// You can also get rid of a protocol by prefixing it
// with NOT or !

// Locates any HTTP frames where the error code is 400 or greater



// Since this appears as a string on the wire, we convert to
// a number using StringToNumber plugin.  Errors 400 and above
// in HTTP represent errors rather than warnings or informational
// messages.

//  NOTE:
//  This filter detects protocol errors or correctness of parsing and
//  will often return no frames.

// Filter finds all TCP traffic on port 80.  This
// also includes reassembled port data since for
// reassembled frames the TCP Transport layer is
// replaced.