In this post, I am going to focus on a capture filter I created to solve a specific problem. Capture filters are less intuitive, as they are cryptic when compared to display filters. Capture filters use a syntax of byte offsets, hex values, and masks coupled with booleans to filter. Display filters aren’t that hard to write once you’ve created a few. Display filters use a syntax of boolean operators and fields that intuitively describe what you’re filtering on. Display filters are used when you’ve captured everything, but need to cut through the noise to analyze specific packets or flows.Ĭapture filters and display filters are created using different syntaxes.

Capture filters only keep copies of packets that match the filter. Running on Linux 5.19.13-arch1-1, with Intel(R) Core(TM) i7-7700HQ CPU 2.80GHz (with SSE4.2), with 15852 MB of physical memory, with GLib 2.74.0, with PCRE2 10.40, with zlib 1.2.12, with libpcap 1.10.1 (with TPACKET_V3), with c-ares 1.18.1, with GnuTLS 3.7.8, with Gcrypt 1.10.1-unknown, with nghttp2 1.50.0, with brotli 1.0.9, with LZ4 1.9.4, with Zstandard 1.5.2, with LC_TYPE=en_CA.UTF-8, binary plugins supported.In Wireshark, there are capture filters and display filters. Compiled (64-bit) using GCC 12.2.0, with GLib 2.74.0, with PCRE2, with zlib 1.2.12, with libpcap, with POSIX capabilities (Linux), with libnl 3, with Lua 5.2.4, with GnuTLS 3.7.8 and PKCS #11 support, with Gcrypt 1.10.1-unknown, with Kerberos (MIT), with MaxMind, with nghttp2 1.50.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.10.2, without libsmi, with binary plugins. There is NO WARRANTY not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This is free software see the file named COPYING in the distribution.

Wireshark capture filter port