Wireshark capture filter

Capture by instead:

sudo wireshark -f http -k
sudo wireshark -f icmp -k

Filter by both protocol and host:

sudo wireshark -f 'host 192.168.1.102 and icmp' -k

For application layer capture filtering, the best you can do is by port:

sudo wireshark -f 'tcp port 80'

There is an http filter but only for as a wireshark display filter

 Ancestors

There are no discussions about this article yet.