The 'Filter Expression' dialog box can help you build display filters. For display filters, try the display filters page on the Wireshark wiki. For example, to capture only packets sent to port 80, use: dst tcp port 80Ĭouple that with an http display filter, or use: tcp.dstport = 80 & httpįor more on capture filters, read ' Filtering while capturing' from the Wireshark user guide, the capture filters page on the Wireshark wiki, or pcap-filter (7) man page. If you want to measure the number of connections rather than the amount of data, you can limit the capture or display filters to one side of the communication. If you enter an invalid one, the background turns from.

As you write, the system will do a system check of the filter string. Note that a filter of http is not equivalent to the other two, which will include handshake and termination packets. Simply click on the filter name or double-click the string to edit it. For a complete list of system requirements and supported platforms, please consult the Users Guide.

Ping packets should use an ICMP type of 8 (echo) or 0 (echo reply), so you could use a capture filter of: icmpĪnd a display filter of: icmp.type = 8 || icmp.type = 0įor HTTP, you can use a capture filter of: tcp port 80 All present and past releases can be found in our download area. A comprehensive reference of filter fields can be found within Wireshark and in the display filter reference at FILTER SYNTAX Check whether a field or protocol exists The simplest filter allows you to check for the existence of a protocol or field.

Filter https wireshark