How to view the captured packets you're interested in
Unless you specify a filter when you create the capture file in Wireshark, you’ll see all the captured packets in the packet list pane. If you chose to perform a “promiscuous mode” capture then you could see packets from multiple sources. Now while it can be useful to have an overview of everything, usually when troubleshooting a problem or trying to understand a network “conversation,” you’ll want at some point to restrict the packet list based on certain criteria. For example, you may only be interested in traffic to or from a given host. It turns out that that’s quite easy. There’s a “filter” field just below the button bar in which you can type a filter expression that will limit the display. If you want to see only packets coming into or going out of 10.10.1.20, simply enter ip.addr == 10.10.1.20 in this filter field and hit Enter. (If you want to only see outbound packets from this address, use ip.src instead of ip.addr. If you want inbound packets only, use ip.dst.) If you want to see only packets for a specific protocol, it’s even easier: just type in the protocol name (ARP, DNS, HTTP, etc.) in the filter field. There are 935 supported protocols, so you should be able to choose the one you want! To clear the filter, click the Clear button to the right of the filter field, and all your packets will reappear in the packet list. So how do you learn the syntax for Wireshark filter expressions? Click the Expression.. button next to the filter field. This brings up a dialog box showing and all possible field names and operators. You can construct a filter expression here and when you close the dialog box, it will appear in the filter field (although you still have to press Enter). One of the coolest design touches about Wireshark is that if you enter a filter expression that is syntactically invalid, the background of the filter field turns red. Once you’ve entered a valid expression (whether it’s going to have the desired effect or not!), the background turns green. Simple feedback mechanism but very effective. Why can’t we get something like this at the Windows command prompt?
