In Wireshark, what is the difference between a capture filter and a display filter, and what does the display-filter syntax look like for common protocols?
A capture filter decides which packets are recorded to disk in the first place (you can't get them back later); a display filter just hides/shows already-captured packets without discarding anything. They use completely different syntaxes.
Capture filter vs display filter:
| Capture filter | Display filter | |
|---|---|---|
| When | Before/during capture | After capture, on stored packets |
| Effect | Packets NOT matching are dropped permanently | Packets only hidden from view, still in the file |
| Syntax | BPF, e.g. tcp port 80, host 8.8.8.8 |
Wireshark's own, e.g. tcp.port == 80, ip.addr == 8.8.8.8 |
| Risk | Too narrow → you lose data you needed | None — just change the filter to see more |
Rule of thumb: capture broadly, then narrow with display filters. You can always re-filter the display; you can never un-drop a capture.
Common display filters (as used to isolate each protocol):
arp all ARP traffic
icmp ping / tracert
tcp.port == 80 TCP to/from port 80 (HTTP)
udp.port == 67 || udp.port == 68 DHCP (or just: dhcp)
udp.port == 53 DNS (or just: dns)
http HTTP requests/responses
http.request.method == "GET" only GET requests
tls TLS / HTTPS handshake + records
ftp FTP control channel
frame.number in {20..23} packets numbered 20 through 23
http && ip.addr == 1.2.3.4 combine conditions with &&
Note the operators: Wireshark display filters use == for equality, && / and for AND, || / or for OR. A protocol name on its own (dns, arp, tls) matches any packet that contains that protocol.
Why two systems exist: capture filters run in the kernel/libpcap at line rate, so they must be cheap and simple (BPF). Display filters run on already-decoded packets, so they can be richer — they can reach into any decoded field (tcp.flags.syn == 1, dns.flags.response == 1).
Tip: A failed connection you forgot to capture is gone forever. When in doubt during a live investigation, capture everything and filter the display afterward.
Go deeper:
Wireshark User's Guide — Filtering packets while viewing — the official reference for display-filter syntax, fields, and comparison operators.
Wireshark wiki — CaptureFilters (BPF) — the other syntax: libpcap/BPF capture filters with copy-paste examples for hosts, ports, and protocols.- Pakete lügen nicht — Protokollanalyse mit Wireshark (Leutert/Studerus, PDF, German) — a practitioner talk walking real troubleshooting cases (session hang-up, slow printing, bad WAN throughput) through Wireshark.