1. CaptureFilters - The Wireshark Wiki

Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library.

See tcpdump.

1. DisplayFilters - The Wireshark Wiki

ip.addr == 172.16.1.0/24
ip.addr == 172.16.2.12

• ICMP and contain specified network

icmp && ip.addr in { 172.16.1.0/24 172.16.2.0/24 }

Display OSPF packet only, but will not show hello packet.

ospf && !ospf.hello

# Show Summary LSA
ospf && ospf.lsa.summary
# Show ASBR Summary LSA
ospf && ospf.lsa.asbr
# Show Type 5 AS External LSA
ospf && ospf.lsa.asext
# Show Type 7 AS External LSA(NSSA)
ospf && ospf.lsa.nssa

• or you can specify LSA Type Number.

# Show Type 3 LSA
ospf.lsa == 3
# Show Type 5 or 7 LSA
ospf.lsa in {5 7}

• Show ASBR Summary LSA or Type 1 Router LSA

ospf.lsa.asbr || ospf.lsa.router

• Specific type LSA and Link State ID

ospf.lsa in {3 5 7} && ospf.lsa.id == 0.0.0.0

!ospf && !igmp && (pim || (icmp && icmp.type != 3 ) || ip.addr  == 224.0.0.0/4)
!ospf && (pim || (icmp && icmp.type != 3 ) || igmp || ip.addr  == 224.0.0.0/4)
igmp || (udp.port == 8888 && ip.addr  == 224.0.0.0/4)

Which? Capture Filter? Display Filter?

icmpv6
icmpv6 and icmpv6.type == 133
icmpv6 and icmpv6.type in {134 133}

1. CaptureFilters - The Wireshark Wiki
2. DisplayFilters - The Wireshark Wiki
3. ProtocolReference - The Wireshark Wiki