Which Wireshark filters do you use most, and how is a capture filter different from a display filter?
Show the answer
Say this first
A capture filter uses BPF syntax, like tcpdump, and decides what gets saved: smaller files, but whatever
it excludes is gone. A display filter uses Wireshark's own syntax and only hides packets already captured.
My everyday display filters are ip.addr == 10.10.0.25, tcp.port == 443, tcp.analysis.flags for
retransmissions and window problems, tcp.flags.reset == 1, dns, icmp, and
tcp.flags.syn == 1 && tcp.flags.ack == 0 to see connection attempts.
Go deeper
Two syntaxes
| Capture filter (BPF) | Display filter | |
|---|---|---|
| Example | host 10.10.0.25 and tcp port 443 | ip.addr == 10.10.0.25 && tcp.port == 443 |
| Applies | while capturing | after capturing |
| Also used by | tcpdump, dumpcap | tshark with -Y |
Display filters worth knowing by heart
| Filter | Shows |
|---|---|
ip.src == 10.10.0.25 && ip.dst == 10.30.0.15 | one direction only |
tcp.analysis.flags | anything flagged: retransmissions, dup ACKs, zero window, lost segments |
tcp.analysis.retransmission | retransmissions only |
tcp.analysis.zero_window | a receiver advertising a zero window |
tcp.flags.syn == 1 && tcp.flags.ack == 0 | new connection attempts |
tcp.flags.reset == 1 | resets |
tcp.stream eq 7 | one conversation; also Follow TCP Stream |
dns.flags.rcode != 0 | DNS errors such as NXDOMAIN and SERVFAIL |
icmp.type == 3 | destination unreachable, including fragmentation needed (code 4) |
arp.duplicate-address-detected | two MAC addresses claiming one IP |
frame.time_delta_displayed > 1 | gaps of more than a second between displayed packets |
Habits
Use Statistics, Conversations to find the heavy talkers, and Expert Information for a quick list of problems. Set the time display to "seconds since previous displayed packet" when hunting for delays.
They will ask next
How do you capture on a Linux server with no GUI?
tcpdump -ni eth0 -w /tmp/app.pcap host 10.30.0.15 and tcp port 443, then open the file in Wireshark.-nskips name lookups, and-wwrites raw packets instead of text.Where do you capture to prove who dropped a packet?
At both ends at the same time, with synced clocks. A packet that leaves A and never arrives at B was lost in between. Then move the capture points closer together: divide and conquer with captures.
Traps
- A capture filter so tight that ARP, DNS and ICMP errors, the evidence you needed, were never saved.