Which of the following is a combined filter to capture HTTP requests or TLS Client Hello, while excluding SSDP?

• A. (http.request or tls.handshake.type == 2) and !(ssdp)
• B. (http.request or tls.handshake.type == 1) and !(ssdp)
• C. (http.request and tls.handshake.type == 1) and !(ssdp)
• D. (http.request or tls.handshake.type == 1) and ssdp

Answer: (B)

The filter is built to capture two kinds of traffic and exclude one to keep the view focused. HTTP requests are identified by http.request, and TLS Client Hello messages are identified by tls.handshake.type == 1. Combining these with OR means you’ll include packets that are either HTTP requests or TLS Client Hello messages. Then you apply a not exclusion for SSDP with and not ssdp, so any SSDP traffic is removed from the results.

Why this is the best choice: using the OR between http.request and tls.handshake.type == 1 correctly covers both desired packet types (HTTP requests and TLS Client Hello) without trying to force them to be present at the same time. The NOT SSDP at the end ensures SSDP traffic won’t appear in the results, which is necessary since SSDP could be present on the same capture but is not part of the desired set.

Why the other forms don’t fit: using TLS handshake type 2 would target TLS Server Hello, not the Client Hello you want. Requiring both conditions with and (http.request and tls.handshake.type == 1) would only match packets that are simultaneously an HTTP request and a TLS Client Hello, which doesn’t happen. Including SSDP positively (and ssdp) would bring in SSDP traffic, defeating the goal of excluding it.

Final filter: (http.request or tls.handshake.type == 1) and !(ssdp)