tcp and ip.addr==192.168.137.3 and (not ssh)
表达式为：ip.addr == 192.168.0.1,或者 ip.src == 192.168.0.1 or ip.dst == 192.168.0.1
客户端 端口52274:
C:UsersTLCB>netstat -na | findstr 192.168.137.3
TCP 192.168.137.1:51568 192.168.137.3:22 ESTABLISHED
TCP 192.168.137.1:52274 192.168.137.3:9 TIME_WAIT
