Guide
Writing capture and display filters without memorising the syntax
Wireshark and tcpdump are the standard tools for looking at network traffic, and both are driven by filters. They use two different languages. People remember one, forget the other and end up searching for the syntax each time. The builder lets you describe what you want as a list of rules and writes both versions.
Two filters for two jobs
A capture filter decides which packets are recorded in the first place. It uses Berkeley Packet Filter (BPF) syntax, the same in tcpdump and in Wireshark’s capture options, and it runs inside the kernel, so it is efficient. A display filter works on packets already captured, using Wireshark’s own field names such as ip.addr and tcp.port; it is far more expressive and can be changed at any time. They look different and are not interchangeable. A mistake in one is rejected by the other, and the builder writes each correctly.
Building the rule list
Each row has a type and a value. Types are host (source or destination), source host, destination host, network in CIDR form, port (TCP or UDP), source port, destination port, port range, protocol, a TCP flag that is set, a packet length greater or less than a value, a VLAN ID and a MAC address. “NOT” negates a rule and “Remove” deletes it. Choose “AND (all must match)” or “OR (any may match)” to combine the rules. Add a rule adds a row, and Sample fills in a typical example.
What the outputs look like
Both outputs have copy and download buttons. The BPF filter appears with a ready-to-use command, for instance tcpdump -i eth0 '...'. The display filter uses == for comparisons, && and || for logic. Port rules match TCP or UDP, so a port rule produces tcp.port == 443 || udp.port == 443 in Wireshark and port 443 in BPF. A protocol rule such as DNS, HTTP or TLS is naturally a display filter, because BPF has no idea of application protocols, so the two outputs can differ for such rules; read the note the page prints under the filters.
A worked example
The sample combines three rules: the host 192.0.2.10, the port 443 and the protocol tcp, joined with AND. The capture filter is host 192.0.2.10 and port 443 and tcp, used as tcpdump -i eth0 'host 192.0.2.10 and port 443 and tcp'. The display filter is ip.addr == 192.0.2.10 && (tcp.port == 443 || udp.port == 443) && tcp. The two say the same thing in their own languages: traffic to or from that address on port 443, over TCP.
Limits
The builder covers the common cases. Complex expressions such as byte-offset tests, regular expressions, “contains” matches or protocol-specific fields are written by hand using the Wireshark documentation. Syntax can differ slightly between versions, and filters on VLAN-tagged traffic in BPF depend on where vlan appears in the expression. Test a capture filter on a quiet interface before relying on it, because a wrong one silently records nothing. Decode the packets you capture with the Packet Header Decoder.
Related tools
- Packet Header Decoder names every field of a captured packet.
- TCP Flags Decoder explains the flag combinations you can filter on.
- Port Number Lookup finds the port a protocol uses.
- Subnet Calculator gives the CIDR network for a network rule.
Checked against the current version of the Wireshark Filter Builder on .