Wireshark's Display Filter Reference

A reference to the powerful array of Wireshark's display filters:

http://www.wireshark.org/docs/dfref/

This list can also be obtained with the command line:

tshark -G

Wireshark match operator

matches   Does the protocol or text string match the given Perl regular expression?

fix.MsgType == "D" and fix.SecurityDesc matches "CLT|NGT"


The "matches" operator allows a filter to apply to a specified Perl-compatible regular expression (PCRE). The "matches" operator is only implemented for protocols and for protocol fields with a text string representation.

More information on PCRE can be found in the pcrepattern(3) man page (Perl Regular Expressions are explained in http://perldoc.perl.org/perlre.html).

Wireshark tools

capinfos eth2_20120131_224001.pcap


editcap -i 120 eth2_20120131_224001.pcap eth2.pcap


editcap -A "2012-01-31 17:44:00" -B "2012-01-31 17:48:00" eth2_20120131_224001.pcap eth2_20120131.pcap