Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library.
TODO
BPF(Berkeley Packet Filter) Syntax
man 7 pcap-filter
ip.addr == 172.16.1.0/24 ip.addr == 172.16.2.12
icmp && ip.addr in { 172.16.1.0/24 172.16.2.0/24 }
Display OSPF packet only, but will not show hello packet.
ospf && !ospf.hello
# Show Summary LSA ospf && ospf.lsa.summary # Show ASBR Summary LSA ospf && ospf.lsa.asbr # Show Type 5 AS External LSA ospf && ospf.lsa.asext # Show Type 7 AS External LSA(NSSA) ospf && ospf.lsa.nssa
# Show Type 3 LSA ospf.lsa == 3 # Show Type 5 or 7 LSA ospf.lsa in {5 7}
ospf.lsa.asbr || ospf.lsa.router
ospf.lsa in {3 5 7} && ospf.lsa.id == 0.0.0.0
Which? Capture Filter? Display Filter?
icmpv6 icmpv6 and icmpv6.type == 133 icmpv6 and icmpv6.type in {134 133}