Wireshark 1

Filters

Any time you’re analyzing network traffic, you’ll want to shut down applications sending packets you don’t want to see to narrow the traffic. Even then, you’ll likely be left with a lot of residual packets to sift through. That’s where Wireshark’s filters come into play. It offers capture filters and display filters, and both affect the capture file differently.

Capture filters are applied to the capture file before the recording process begins, allowing you to decide which packets Wireshark will capture. Display filters, on the other hand, are applied to a capture file after the capture, allowing you to only see packets that meet your specific criteria.

To add a capture filter, click in the entry field above the interfaces shown in the launch window. You can type a filter in, such as TDP, or click the bookmark icon to the left and pick from a drop-down list. For more options, after clicking the green bookmark icon, select “manage capture filters”.