Display filters are flexible and powerful when compared to capture filters. Display filters do not discard any packets; instead, the packets are hidden. Discarding packets is not a very effective practice because, once the packets are dropped, they cannot be recovered. Applying a display filter will limit the packets to be displayed in the list pane of Wireshark.
A display filter can be used for a capture file and live traffic in the Filter dialog box located above the Packet List Pane. Display filters support variety of arguments such as IP, port, protocol, and so on.
Let's learn how to use the display filter expression dialog for creating filters.
The filter expression
- Click on the Expression button to configure a display ...
