Difference display filter and capture filter Capture filter As mentioned before, I'll add IPv6 filters, some more context for when I use certain filters, more topics like OSPF, HTTP/s, and so others, and some more functions. In an attempt to keep it to the basics, I left out topics like functions, variables, macros, arithmetic operators, and some other advanced things. I'd appreciate it, and I am happy to learn. If you think I forgot something important or want to share more tips, feel free to reach out. I've added links to the specific category to every protocol in the rest of the post. Nevertheless, a list of all display filters can be found here. In general, it is recommended to use the right-click function to add specific protocols/ fields/ values, etc, to the filter. There is no way to list every filter, and I try to concentrate on the most commonly used ones.

Wireshark offers a wide range of tools that are out of this post's scope. In this post, I'll focus on the display filters for IPv4 only. The display filter is used to filter a packet capture file or live traffic, and it is essential to know at least the basics if you want to use Wireshark for troubleshooting and other evaluations. This post is a quick reference for using the display filters in Wireshark.

Wireshark filter port range