tcp and ip.addr==192.168.137.3 and (not ssh)
   
表达式为：ip.addr == 192.168.0.1,或者 ip.src == 192.168.0.1 or ip.dst == 192.168.0.1


客户端 端口52274:
C:\Users\TLCB>netstat -na | findstr 192.168.137.3
  TCP    192.168.137.1:51568    192.168.137.3:22       ESTABLISHED
  TCP    192.168.137.1:52274    192.168.137.3:9        TIME_WAIT

wireshark演示四次挥手_客户端

wireshark演示四次挥手_客户端_02

wireshark演示四次挥手_wireshark_03

wireshark演示四次挥手_客户端_04