How it works...

The display filters are a proprietary Wireshark language. There are many places that display filters can be used, which will be discussed in following chapters when we talk about protocols. Additional filters will be discussed in following recipes in this chapter.

You can always use the autocomplete feature to complete filter strings. For example, if you type in tcp.f as shown in the following screenshot, the autocomplete feature lists possible display filter values that could be created beginning with tcp.f, that is, TCP flags (SYN, FIN, RST, and so on):