1. CaptureFilters - The Wireshark Wiki

Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library.

TODO

BPF(Berkeley Packet Filter) Syntax

man 7 pcap-filter

1. DisplayFilters - The Wireshark Wiki

ip.addr == 172.16.1.0/24
ip.addr == 172.16.2.12

• ICMP and contain specified network

icmp && ip.addr in { 172.16.1.0/24 172.16.2.0/24 }

Display OSPF packet only, but will not show hello packet.

ospf && !ospf.hello

# Show Summary LSA
ospf && ospf.lsa.summary
# Show ASBR Summary LSA
ospf && ospf.lsa.asbr
# Show Type 5 AS External LSA
ospf && ospf.lsa.asext
# Show Type 7 AS External LSA(NSSA)
ospf && ospf.lsa.nssa

• or you can specify LSA Type Number.

# Show Type 3 LSA
ospf.lsa == 3
# Show Type 5 or 7 LSA
ospf.lsa in {5 7}

• Show ASBR Summary LSA or Type 1 Router LSA

ospf.lsa.asbr || ospf.lsa.router

• Specific type LSA and Link State ID

ospf.lsa in {3 5 7} && ospf.lsa.id == 0.0.0.0

Which? Capture Filter? Display Filter?

icmpv6
icmpv6 and icmpv6.type == 133
icmpv6 and icmpv6.type in {134 133}

1. CaptureFilters - The Wireshark Wiki
2. DisplayFilters - The Wireshark Wiki
3. ProtocolReference - The Wireshark Wiki