Capture filters

Do not confuse packet filters with display filters (such as tcp.port == 80). The former are much more limited and are used to reduce the size of packet capture. The latter are used to hide certain packets from the packet list.

Capture filters are set before packet capture and cannot be modified during capture. However, display filters do not have this limitation and can be modified on the fly.

You can find capture filters, for example, from the start window as demonstrated in the image.

Examples

Capture only the traffic that is coming to or going from the specified IP address.

host 10.0.0.1

Only capture traffic coming to or going from the specified IP address range.

net 10.0.0.1/16

Capture only the traffic coming from the specified IP address range.

src net 10.0.0.1/16

Just intercept the traffic that goes to the specific IP address range.

dst net 10.0.0.1/16

Steal only DNS traffic (port 53).

port 53

Capture traffic related to a specific address and there is no HTTP or SMTP traffic.

host 192.168.1.10 and not port 80 and not port 25

Capture traffic that is not ARP or DNS traffic.

port not 53 and not arp

Capture TCP traffic related to a specific port range.

tcp port range 5000-6000

Capture only IPv4 traffic.

p.m