Chapter 5 - Filters

Abstract

Filters are used to manage huge amount of information that Wireshark capture from a network interface. Capture filters allow the user to limit the amount of packets that Wireshark receives from the OS. Display filters allow the user to limit the packets that are shown in Wireshark s main window. Wireshark's capture filter syntax is the same as tcpdump's filter syntax. This is because both Wireshark and tcpdump use a library called libpcap, which is the library that provides the filter engine. Wireshark s display filter syntax is unique to Wireshark. It is part of Wireshark s protocol dissection engine, and provides names for almost all protocols and fields that Wireshark can dissect. Capture filters are good for quickly discarding packets from a live network interface, and display filters are good for fine-tuning which packets you see after they have been loaded into Wireshark. Display filters rely on a complete dissection of the packet by Wireshark, and thus are much slower than capture filters.