Wireshark - Configure Display Filters

Flashcards covering key vocabulary and concepts related to configuring and managing display filters in Wireshark, based on the provided lab notes.

Display filters (filter expressions)

Normally applied to already captured network traffic in a packet capture file and used when the analyst does not exactly know the type of traffic to examine.

Filter Input box

A search box at the top of the Main Wireshark Window, labeled 'Apply a display filter', where one inserts display filter(s).

Filter Toolbar

The entire section containing the 'Apply a display filter' search box and related buttons.

Display filter button

A feature that allows users to save and reuse specific display filters, created by clicking the '+' sign in the Filter Toolbar.

Label (Filter Button Preference)

The box where one names a display filter button (should be descriptive).

Filter (Filter Button Preference)

The box where one enters the actual display filter, which turns green if the syntax is correct.

Comment (Filter Button Preference)

The box where one enters a note regarding the created filter button.

'X' button (display filter)

Used to delete the current display filter and return to the original packet capture, resetting the current display filter and clearing the edit area.

Bookmarks icon (blue ribbon)

Located on the very left of the filter input box, it provides a dropdown menu of predefined display filters (both capture and display) to save time.

'udp.dstport==53'

A display filter used to show only those packets that have '53' in the destination port field for UDP traffic.

'tcp.port==80'

A display filter used to display TCP packets that also contain the number '80' in either the source or destination port field.

Apply as Filter (filter button option)

Copies the selected display filter into the filter input box.

Prepare as Filter (filter button option)

Edits the filter.

Edit (filter button option)

Opens Filter Button Preferences so that one can edit the display filter.

Disable (filter button option)

Removes a display filter from display, which can be re-enabled in Preferences > Filter Buttons.

Remove (filter button option)

Completely deletes a display filter.

Analyze > Display Filters

A menu path in Wireshark used to manage display filters, allowing one to add, delete, and copy them.

Display Filter comparison operators

Symbols and aliases such as '==' (eq), '!=' (ne), '>' (gt), '

'matches' operator

A display filter comparison operator that allows a protocol or text field to match a Perl-compatible regular expression (e.g., http.host matches 'acme.(org|com|net)').

Applying display filters during capture

Wireshark allows display filters to be entered and applied while packets are being captured, showing only conforming traffic but still saving all captured packets.