Wireshark capture filters (BPF)
You learn to filter traffic while capturing it: BPF capture filters (host, port, direction, not) in Wireshark’s Capture Options and with dumpcap on the command line, how they differ from display filters, BPF in compiled form, saved capture filters, automatic stop by packet count and duration; you prove that each capture holds only the traffic you wanted.
Level 101 · 50 min
Daniel has a new job: "There’s a problem on the web server. If we record the whole network the disk fills up and we collect personal data for nothing. Capture only that server’s traffic."
A capture filter drops packets before they are written to disk: a packet that doesn’t match is never recorded. It uses a separate, simpler language called BPF (Berkeley Packet Filter): host web.lab, tcp port 80, udp port 53, not arp. A display filter only filters the view after the capture is taken. The figure shows the two stages side by side.
In this lesson you make real traffic: web.lab (HTTP) and gw.lab (DNS) on the lab network are your targets. ~/ws/gorev.txt holds the web path and DNS name to request in this lab; they differ in every lab. Close any Wireshark windows left open from earlier lessons: the desktop runs with 2 GB of memory.
What you will do in this lesson
- Interfaces and the task
- A capture filter in Wireshark
- Capturing from the command line: dumpcap -f
- Direction and port: tcp dst port 80
- Inside BPF, and its limits
- A saved capture filter
- Task: only the web conversation
- Task: exactly 10 DNS packets
- Short quiz
Skills you will earn
- Capturing from the command line with dumpcap
- Taking only the needed traffic with a capture filter
- BPF syntax, directions and limits
- Saving capture filters by name
- Stopping a capture by duration or packet count
← Wireshark display filters · Wireshark fundamentals · Following a TCP stream in Wireshark →
Start for free