While researching, I found this page from the Wireshark blog that got me some of the way to my goal. This seemed more efficient than using a display filter, since I wasn’t certain I’d find any packets like this on my home lab network where I was performing the capture. I wanted the Wireshark to capture IP packets with a non-zero DSCP value. In this post, I am going to focus on a capture filter I created to solve a specific problem. Capture filters are less intuitive, as they are cryptic when compared to display filters. Capture filters use a syntax of byte offsets, hex values, and masks coupled with booleans to filter. Display filters aren’t that hard to write once you’ve created a few. Display filters use a syntax of boolean operators and fields that intuitively describe what you’re filtering on. Display filters are used when you’ve captured everything, but need to cut through the noise to analyze specific packets or flows.Ĭapture filters and display filters are created using different syntaxes. Capture filters only keep copies of packets that match the filter. In Wireshark, there are capture filters and display filters.

Tshark display filter