Ethernet and Coffee

Wireshark’s tcp.port==n and udp.port==n display filters contain an implicit OR so that they apply to both source and destination port numbers.

Unfortunately, if you want to filter on a range of ports like (tcp.port > 5000 and tcp.port < 6000) the implicit OR ends up including packets that have ports outside of that range.

If you want to filter on a range, use dstport and srcport like this:

((tcp.dstport > 5000 and tcp.dstport < 6000) or (tcp.srcport > 5000 and tcp.srcport < 6000))