Capture Filters

Capture filters are applied before Wireshark records packets. They use the Berkeley Packet Filter (BPF) syntax and are much faster than display filters because they drop packets at the kernel level.

Capture vs Display Filters

Capture filters decide what gets saved to disk. Display filters decide what you see on screen. Use capture filters when you know what you want and need to reduce file size or CPU load.

Where to Set Capture Filters

Before starting a capture, enter your filter in the Capture Filter field at the top of the main window, next to the interface list. You can also set them via the command line.

Basic Syntax

BPF expressions consist of one or more primitives. Primitives usually consist of an identifier (name or number) preceded by one or more qualifiers.

BPF Syntax

1[qualifier] [identifier]

Common Qualifiers

Qualifier	Description
host	IP or hostname
net	Network with optional mask (e.g., /24)
port	TCP or UDP port number
portrange	Range of ports
src	Source qualifier (can prefix host/port)
dst	Destination qualifier (can prefix host/port)
ether	Ethernet (MAC) address
proto	Protocol (ip, ip6, arp, rarp, tcp, udp, icmp)

Host & Port Filters

bpf

host 192.168.1.1

Traffic to or from host 192.168.1.1

bpf

net 192.168.1.0/24

Traffic to or from the 192.168.1.0/24 subnet

bpf

port 80

Traffic on port 80 (HTTP)

bpf

portrange 1000-2000

Traffic on ports 1000 through 2000

bpf

src host 10.0.0.1

Traffic originating from 10.0.0.1

bpf

dst host 10.0.0.1

Traffic destined for 10.0.0.1

bpf

src port 53

Traffic from source port 53

bpf

dst port 443

Traffic to destination port 443

Protocol Filters

bpf

tcp

Only TCP traffic

bpf

udp

Only UDP traffic

bpf

icmp

Only ICMP (ping) traffic

bpf

arp

Only ARP traffic

bpf

ip6

Only IPv6 traffic

bpf

not arp

Exclude ARP traffic

bpf

tcp or udp

TCP or UDP traffic

bpf

not tcp port 80

All traffic except TCP port 80

Advanced BPF Expressions

You can combine primitives with logical operators: and, or, not, and () for grouping. You can also inspect raw packet bytes.

bpf

tcp[13] & 2 != 0

TCP SYN packets only

bpf

tcp[13] & 16 != 0

TCP ACK packets only

bpf

icmp[icmptype] == icmp-echo

ICMP echo request (ping)

bpf

ether host 00:11:22:33:44:55

Traffic to/from MAC address

bpf

len > 100

Packets larger than 100 bytes

bpf

ip[2:2] > 576

IP packets with total length > 576

TCP Flags Cheat Sheet

TCP flags are in byte 13 of the TCP header: FIN=1, SYN=2, RST=4, PSH=8, ACK=16, URG=32. So tcp[13] & 18 != 0 matches SYN-ACK packets.

Common Real-World Examples

Examples

1# Capture only HTTP traffic from a specific host tcp port 80 and host 192.168.1.50  # Capture DNS queries (UDP port 53) excluding a server udp port 53 and not host 8.8.8.8  # Capture SSH traffic to or from any host port 22  # Capture all traffic except your own machine not host $(hostname -I | awk '{print $1}')  # Capture ICMP echo requests only icmp[icmptype] == icmp-echo  # Capture all non-ARP traffic on a subnet not arp and net 10.0.0.0/8  # Capture TCP traffic with the SYN flag set tcp[13] & 2 != 0  # Capture traffic on multiple specific ports port 80 or port 443 or port 22

Using with tshark / dumpcap

Capture filters work identically in command-line tools:

CLI

1# tshark with capture filter
2tshark -f "port 80" -i eth0
3 
4# dumpcap with capture filter
5dumpcap -f "host 192.168.1.1" -i eth0 -w capture.pcap
6 
7# tcpdump (uses same BPF syntax)
8tcpdump -i eth0 "tcp port 443 and host 10.0.0.5"

Important Limitation

Capture filters cannot filter based on application-layer protocols (like HTTP method, DNS query name, or SSL certificate). For those, use display filters after capture.

Next: Display Filters Back