Wireshark Display vs Capture Filters

A common thought by beginner Wireshark users is that display and capture filters do the same thing. Well, they don’t; they may seem to be doing the same thing to you but the difference is when the packets get filtered.

Display filters don’t stop Wireshark from capturing any packets, you still capture all packets but it only displays you the packets you asked for. While capture filters when used make it so Wireshark won’t capture any packets that you have specified not to.

Wireshark_Filters

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s