This will exclude tunnelled IPv6.Ĭapture only IPv6 over IPv4 Tunnelled Traffic. It will include the multicast queries and listenners (MLD) traffic.Ĭapture IPv6 Native Traffic Only. Example: tcp portrange 20-21 will capture all FTP traffic.Ĭaptures PPPOE traffic for a particular host.Ĭaptures PPPOE traffic for a paticular host and a particular port (HTTP in the example).Ĭaptures all IPv6 traffic within the local network that is multicast (such as Neighbor and Router advertisements). The two commands above are the same result.Ĭapture traffic within a range of ports. Another example: port 53 for DNS traffic.Ĩ. host and not (port xx or port yy) or not port xx and not port yyĬapture all traffic, exclude specific packets. Example: ether host 01:0c:5e:00:53:00Ĭaptures VLAN traffic for a particular host.Ĭaptures VLAN traffic for a paticular host and a particular port (HTTP in the example).Ĭaptures only IP (ip is IPv4, ip6 is IPv6) traffic.Ĭapture single source or destination port traffic. Capitalizing hexadecimal letters does not matter.

The two commands are the same result.Ĭapture traffic with a source range of IP addresses.Ĭapture traffic with a destination range of IP addresses.Ĭaptures only traffic to or from the MAC address used. net #.#.#.#/24 or net #.#.#.# mask 255.255.255.0Ĭapture traffic to or from (sources or destinations) a range of IP addresses. Here are our favorites.Ĭapture only traffic to or from a specific IP address.

Unlike Wireshark's Display Filter syntax, Capture filters use Berkley Packet Filter syntax. Of course you can edit these with appropriate addresses and numbers. Our Udemy course on Wireless Packet capture Our custom profiles repository for Wireshark 5 of 5 - 1 votes Thank you for rating this article.Ĭheck out these great references as well:

List of wireshark filters