Book Image

Wireshark Essentials

Book Image

Wireshark Essentials

Overview of this book

Table of Contents (15 chapters)
Wireshark Essentials
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

Wireshark display filters


Wireshark provides a very wide range of protocol-specific display filters that can be extremely useful for analysis activities by allowing you to focus on specific packets, based on criteria that you define. You can filter on just the traffic that you want to see or filter undesired traffic out of view. Display filters are one of the most helpful features of Wireshark, so they warrant becoming very familiar with.

Display filters can be created in several ways:

  • By applying display filters from the Display Filter window

  • By typing in the display filter syntax (using autocomplete)

  • By applying display filters from the Conversations (or Endpoints) window

  • By applying saved display filters from Filter Expression Buttons

  • Using the Expressions button for assistance creating filters

  • Using right-click menus on specific packet fields

    Note

    Remember that display filters use a proprietary Wireshark filter format, which is protocol-dependent and significantly different from capture filter...