Capture filters
A capture filter is a BPF expression. Frames that miss it are never written, so the syntax and the cost both matter.
The filter runs before the file exists
The capture filter box is in the capture options, not above the packet list. Libpcap evaluates it on each frame and keeps the frames that match. Everything else is discarded. A typo here is not a cosmetic problem. The bytes you needed are gone, and no display filter can recover them.
Use a capture filter when the lab interface is busier than the question. “Only the lab web server” or “only DNS” keeps the file readable and the disk calm. Leave the box empty when you do not yet know which protocol will matter. A wide file can be narrowed later. A narrow file cannot be widened.
BPF, not the display language
Capture filters use a different language from display filters. host, net, and port are the words you will type most often. host 10.8.0.20 keeps frames where that address is source or destination. tcp port 443 keeps TCP on that port in either direction. udp port 53 keeps DNS on UDP. The words and, or, and not combine them.
A display-filter expression typed into this box fails or keeps the wrong frames. tcp.flags.syn == 1 is a display filter. It is not a capture filter. If you need only traffic for one lab host, the capture filter is host 10.8.0.20. You can ask about SYN flags after the file is saved, in the display-filter box.
host 10.8.0.20 and tcp port 443
Worked case: the lab resolver, and nothing else
You are recording the lab DNS server 10.8.0.53 during a software install on 10.8.0.40. The question is which names the client asks for. The capture filter is host 10.8.0.40 and host 10.8.0.53 and udp port 53. The file then contains the UDP DNS conversation between those two machines and skips the file copy that would have dominated the disk.
Halfway through, a name lookup fails over to TCP because a response was truncated. Your filter said udp port 53, so the TCP retry is absent. The absence is the filter. You either accept that limit in the notes or recapture with port 53 and no protocol keyword, which keeps both UDP and TCP to that port. Write the filter string into the notebook next to the filename.
- host 10.8.0.20 keeps one address.
- net 10.8.0.0/24 keeps the lab subnet.
- port 53 keeps UDP and TCP on 53.
- udp port 53 keeps only the UDP half.
A filter is not authorization
A capture filter makes a recording smaller. It does not make a recording allowed. Point it at an interface you are permitted to record, in the lab or on a span that the owner asked for. The frames you keep can still contain names, cookies, and passwords.
If the capture returns no packets, check the interface, the address, and the filter before you conclude the host was silent. A filter of host 10.8.0.20 on the wrong VLAN is an empty file about your setup, not about the server.
Diagram
What a capture filter keeps, and the syntax it accepts
- Question
Name the host or the port you are willing to lose if you filter it out.
- BPF
Write host, net, and port. Combine them with and and or.
host 10.8.0.40 and host 10.8.0.53 and udp port 53
- Save
Frames that miss the filter are not in the file.
- Note
Copy the filter string into the notebook beside the filename.
Which box this expression belongs in
Example. host 10.8.0.20 and tcp port 443
When. Before the frame is stored.
Miss. The frame is gone for good.
Example. ip.addr == 10.8.0.20 && tcp.port == 443
When. After the file exists, on the rows you see.
Miss. The frame is still stored. Clear the box and it returns.
Check yourself
1. You want a lab capture that stores only frames to or from 10.8.0.20. What do you put in the capture filter box?
2. The capture filter was udp port 53. A later TCP lookup on port 53 is missing from the file. Where is it?
3. You need both UDP and TCP DNS in the next capture, still limited to the resolver. Which capture filter matches that?