Using this tool, you can write and save multiple different filters and have them ready to use again in the future.Ĭapture has it’s own syntax for filtering. To save the new filter, just replace the filler with the actual name and expression that you want and click “Ok.” The filter will be saved and applied. It will create a new capture filter populated with filler data. Look around and see what’s there.Īt the bottom of that box, there is a small form for creating and saving hew capture filters. Directly to its left is a button labeled “Capture Filter.” Click on it, and you will see a new dialog box with a listing of pre-built capture filters. Click on the “Capture” tab on the top menu, and go to “Options.” Below the available interfaces is the line where you can write your capture filters. They just determine if two or more things are equal, greater, or less than one another.īefore diving in to custom capture filters, take a look at the ones Wireshark already has built in. They are expressions that use “and,” “or,” and “not” to verify the truthfulness of a statement or expression. If you’ve ever done any kind of programming, you should be familiar with Boolean expressions. Filtering only HTTP requests would be a good example.įor everything else, Wireshark uses Boolean expressions and/or comparison operators. Most correspond to the more common distinctions that a user would make between packets. Start typing in either of the filter fields, and you will see them autocomplete in.

Wireshark has plenty of built-in filters which work just great. Of course, these can be used in conjunction with one another, and their respective usefulness is dependent on which and how much data is being collected.īoolean Expressions and Comparison Operators It can filter an only collect certain packets, or the packet results can be filtered after they are collected. There are two way that Wireshark can filter packets. Wireshark provides two powerful filtering tools to make targeting the exact data you need simple and painless. That can get in the way of the specific data that you are looking for.

As you have seen, Wireshark collects everything by default. Filtering allows you to focus on the exact sets of data that you are interested in reading.

Wireshark capture filter for https