Wireshark Capture Filters vs Display Filters Explained

Wireshark has two filter languages that beginners constantly mix up: capture filters, which are Berkeley Packet Filter (BPF) expressions evaluated in the kernel before a packet is even stored, and display filters, which hide already-captured packets inside Wireshark's dissector engine. Getting them backwards causes either enormous capture files or the confusing situation where "no packets match" even though traffic exists. This article explains both, with examples and the workflow that uses each where it belongs.

Capture Filters: BPF Before the Disk

Capture filters run in the kernel via libpcap/Npcap. Packets that do not match never enter Wireshark at all, so they save disk space and CPU on busy links — but the filter cannot be changed mid-capture and anything filtered out is gone forever. Syntax is the classic tcpdump/BPF style:

host 192.168.1.100              # to/from one host
net 10.0.0.0/24                 # whole subnet
tcp port 80 or tcp port 443     # HTTP/HTTPS
not port 22                     # everything except SSH
src host 10.0.0.5               # source only
icmp or arp                     # specific protocols

Display Filters: DFL After the Capture

Display filters use Wireshark's Display Filter Language: protocol-aware, rich in operators, applied after capture to hide (never delete) packets. You can change them on the fly while the capture runs:

ip.addr == 192.168.1.1
tcp.port == 443
http.request.method == "GET"
tcp.analysis.retransmission        # all retransmissions
dns.qry.name contains "google"
frame.len > 1400                   # jumbo-sized frames
http.response.code >= 400          # 4xx and 5xx
tcp.flags == 0x002                 # pure SYN packets

Operators include ==/eq, !=/ne, >/gt, contains, matches (regex) and the logical and/or/not.

Key Differences at a Glance

• When: capture filters are set before starting; display filters apply any time.
• Performance: capture filters are very efficient (kernel-level, saves disk); display filters consume CPU/RAM as they scan the packet list.
• Syntax: BPF (host 1.2.3.4) vs DFL (ip.addr == 1.2.3.4).
• Data loss: capture filters discard non-matching packets permanently; display filters only hide them.

The Recommended Workflow

Use a broad capture filter to keep the file manageable, then slice with precise display filters during analysis. Investigating a web server problem: capture with host 203.0.113.42 and (tcp port 80 or tcp port 443), then display-filter to http.response.code >= 500 to find server errors, then tcp.analysis.retransmission to see if the network is dropping segments. The capture-side BPF grammar is identical to tcpdump, so everything in our tcpdump BPF filter guide applies; for capture on AOS-CX switches see Aruba AOS-CX packet capture.

原文链接：https://wiki.wireshark.org/CaptureFilters