WireShark - 6.6. Defining and saving filters

6.6. Defining and saving filters
Prev	Chapter 6. Working with captured packets	Next

6.6. Defining and saving filters

You can define filters with Wireshark and give them labels for later use. This can save time in remembering and retyping some of the more complex filters you use.

To define a new filter or edit an existing one, select the Capture Filters... menu item from the Capture menu or the Display Filters... menu item from the Analyze menu. Wireshark will then pop up the Filters dialog as shown in Figure 6.7, “The "Capture Filters" and "Display Filters" dialog boxes”.

	Note!
	The mechanisms for defining and saving capture filters and display filters are almost identical. So both will be described here, differences between these two will be marked as such.

	Warning!
	You must use Save to save your filters permanently. Ok or Apply will not save the filters, so they will be lost when you close Wireshark.

Figure 6.7. The "Capture Filters" and "Display Filters" dialog boxes

New

This button adds a new filter to the list of filters. The currently entered values from Filter name and Filter string will be used. If any of these fields are empty, it will be set to "new".

Delete

This button deletes the selected filter. It will be greyed out, if no filter is selected.

Filter

You can select a filter from this list (which will fill in the filter name and filter string in the fields down at the bottom of the dialog box).

Filter name:

You can change the name of the currently selected filter here.

	Note!
	The filter name will only be used in this dialog to identify the filter for your convenience, it will not be used elsewhere. You can add multiple filters with the same name, but this is not very useful.

Filter string:

You can change the filter string of the currently selected filter here. Display Filter only: the string will be syntax checked while you are typing.

Add Expression...

Display Filter only: This button brings up the Add Expression dialog box which assists in building filter strings. You can find more information about the Add Expression dialog in Section 6.5, “The "Filter Expression" dialog box”

OK

Display Filter only: This button applies the selected filter to the current display and closes the dialog.

Apply

Display Filter only: This button applies the selected filter to the current display, and keeps the dialog open.

Save

Save the current settings in this dialog. The file location and format is explained in Appendix A, Files and Folders .

Close

Close this dialog. This will discard unsaved settings.

Prev	Up	Next
6.5. The "Filter Expression" dialog box	Home	6.7. Defining and saving filter macros