SSDP in wireshark

Question

I start wireshark and enterd in the cmd "ping www.ynet.co.il"

I get packet with protocol SSDP (as describe enter image description here in the attach picture)

what is this mean?

Answer 1

It means that you are capturing all traffic on your network visible to your capture machine because you have not applied any capture or display filters, and apparently you have "Simple Service Discovery Protocol" traffic on your network.

If you want to focus on only the ICMP traffic, either:

• Apply a capture filter of icmp using "Capture -> Options -> Capture filter for selected interfaces: icmp", or
• Apply a display filter of icmp in the Wireshark display filter area at the top of the Wireshark screen.

The difference between a capture filter and a display filter is that a capture filter limits what traffic is captured, while a display filter limits which packets of those captured are actually displayed. While icmp is both a valid capture filter and display filter, in general this is not the case. The general syntax is very different and I would suggest familiarizing yourself with them if you haven't done so already. Some helpful links:

• For specifying capture filters, refer to the pcap-filter man page.
• For specifying display filters, refer to
  • The wireshark-filter man page
  • The Wireshark Display Filter Reference page