Wireshark Series 5 display filter

For our individual users, display filters are more common than capture filters. Display filter is mainly suitable for single environment flow is not large. For those who do not know what kind of data packets are needed, they can only be determined after the packet audit, so display filters are usually used.

After stopping capturing data, enter the filter expression in the filter box above the packet list to display only the packets we want. For example, enter the expression "http" to display only packets using http protocol. Click × on the right side of the filter box to remove the filter rules and redisplay all packets.

(1) Grammar rules

Syntax rules for displaying filters:

In the filter expression used by the display filter, various comparison operators are often used, mainly:

comparison operators

description

==

equal to

!=

not equal to

>

greater than

=

greater than or equal to