Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Mail Systems
Eclipse Documentation

How To Guides
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Problem Solutions
Privacy Policy




6.6. Defining and saving filters

You can define filters with Wireshark and give them labels for later use. This can save time in remembering and retyping some of the more complex filters you use.

To define a new filter or edit an existing one, select the Capture Filters... menu item from the Capture menu or the Display Filters... menu item from the Analyze menu. Wireshark will then pop up the Filters dialog as shown in Figure 6.7, “The "Capture Filters" and "Display Filters" dialog boxes”.

[Note] Note!

The mechanisms for defining and saving capture filters and display filters are almost identical. So both will be described here, differences between these two will be marked as such.

[Warning] Warning!

You must use Save to save your filters permanently. Ok or Apply will not save the filters, so they will be lost when you close Wireshark.

Figure 6.7. The "Capture Filters" and "Display Filters" dialog boxes

The "Capture Filters" and "Display Filters" dialog boxes


This button adds a new filter to the list of filters. The currently entered values from Filter name and Filter string will be used. If any of these fields are empty, it will be set to "new".


This button deletes the selected filter. It will be greyed out, if no filter is selected.


You can select a filter from this list (which will fill in the filter name and filter string in the fields down at the bottom of the dialog box).

Filter name:

You can change the name of the currently selected filter here.

[Note] Note!

The filter name will only be used in this dialog to identify the filter for your convenience, it will not be used elsewhere. You can add multiple filters with the same name, but this is not very useful.

Filter string:

You can change the filter string of the currently selected filter here. Display Filter only: the string will be syntax checked while you are typing.

Add Expression...

Display Filter only: This button brings up the Add Expression dialog box which assists in building filter strings. You can find more information about the Add Expression dialog in Section 6.5, “The "Filter Expression" dialog box”


Display Filter only: This button applies the selected filter to the current display and closes the dialog.


Display Filter only: This button applies the selected filter to the current display, and keeps the dialog open.


Save the current settings in this dialog. The file location and format is explained in Appendix A, Files and Folders .


Close this dialog. This will discard unsaved settings.

  Published under the terms fo the GNU General Public License Design by Interspire