Introduction

In the first and second chapters, we talked about how to install Wireshark, how to configure it for basic and smart operations, and where to locate it on the network. In this chapter and the next one, we will talk about capture filters and display filters.

It is important to distinguish between these two types of filters:

• Capture filters are configured before we start to capture data, so only data that is approved by the filters will be captured. All other data will be lost. These filters are described in this chapter.
• Display filters are filters that filter data after it has been captured. In this case, all data is captured and you configure what data you wish to display. These filters are described in the next chapter.

In some cases, you need to configure Wireshark to capture only a part of the data that it sees over the interface:

• When there is a large amount of data running over the monitored link and you want to capture only the data you care about
• When you want to capture data only going into and out of a specific server on a VLAN that you monitor
• When you want to capture data only from a specific application or applications (for example, you suspect that there is a DNS problem in the network and you want to analyze only DNS queries and responses to and from the internet)

There are many other cases where you want to capture only specific data and not everything that runs on your network. When using the capture filters, only predefined data will be captured and all other packets will be ignored, so you will get only the desired data.

In this chapter, we will describe how to configure simple, structured, byte offset and payload matching capture filters.