HackBlue

Tools · Network tools · 09 / 24

tshark: display filters, and the capture filter you already used

BPF decides what a live capture bothers to store. A display filter decides which stored frames a read will print. Mixing the two spellings is the usual reason a command errors or, worse, prints the wrong set.

14 min read · practice only with authorization

Two languages

A capture filter is BPF: host 10.8.0.20 and tcp port 443. tcpdump puts it at the end of the command. tshark puts it in -f, and only while capturing. Frames that fail the filter are not stored. That is why a sloppy capture filter cannot be fixed later from the same file.

A display filter is the Wireshark language: ip.addr==10.8.0.20 && tcp.port==443. tshark puts it in -Y. It selects frames from a file you already have, or from a live capture after they are buffered. The manual notes that a display filter on a busy live capture is more work than BPF and can drop frames. On a lab pcap, -Y is the right tool.

Habits that keep the set honest

Write the language next to the flag in your notes: -f BPF, -Y display. If the shell says the filter was invalid, check which language you used before you widen the capture. A quoted string inside a display filter uses double quotes: http.request.method == "POST". The whole -Y argument stays in single quotes for the shell.

Filters are not authorization. A correct -Y can still name an address the scope left out. Build the expression from the ticket's hosts. If you need a field name, tshark -G fields is a catalog of this install, and it does not read the network.

  • tcp port 443 is BPF. tcp.port==443 is a display filter.
  • and is BPF. && is a display filter.
  • host 10.8.0.20 is BPF. ip.addr==10.8.0.20 is a display filter.
  • -Y with -r never puts frames back that a capture filter already dropped.

A worked defensive case

A teammate's note says they ran tshark -r /lab/evidence.pcap -f 'ip.addr==10.8.0.20' and got a syntax error, then removed the filter and saved a new file from the live lab NIC with no expression at all. The new file contains every lab host.

You discard that wider file from the case, because the scope named two addresses. You rerun the original pcap with -Y 'ip.addr==10.8.0.20 && ip.addr==10.8.0.40 && tcp.port==443'. The ticket records the mistake as a filter-language mix-up, and the retained evidence is still the bounded capture.

Where this is documented

tshark(1) distinguishes -f from -Y in its opening sections. BPF itself is pcap-filter(7). Display-filter field names come with the dissectors, listed by tshark -G fields.

Use a host-only lab network, or a capture the owner already handed you. These commands read that file or record a single lab host. They are not a scan of the public internet.

Commands

Display filter against the file you already have
tshark -r /lab/evidence.pcap -Y 'ip.addr==10.8.0.20 && tcp.port==443' -c 20
Look up a field name locally, without capturing
tshark -G fields | awk -F'\t' '$3 == "tcp.port" || $3 == "ip.addr" { print $3 }'

Diagram

Which spelling goes with which flag

Three ways to name port 443

  • tcpdump or tshark -f

    BPF: tcp port 443. This chooses what a live capture stores.

  • tshark -Y

    Display filter: tcp.port==443. This chooses what a read prints from a file.

  • A mixed command

    BPF words inside -Y, or display-filter words inside tcpdump, are a syntax error. Fix the language. Do not drop the filter.

Check yourself

1. You are reading /lab/evidence.pcap and want only port 443. Which command matches the manual?

2. The live capture used BPF host 10.8.0.40 only. The ticket later asks about 10.8.0.20. What can -Y do?

3. tshark rejects the filter and a teammate deletes it so the command runs. What do you do instead?