Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What does capture filter means in wireshark? Is it same as display filter?

share|improve this question

closed as off-topic by AviD Aug 27 '13 at 13:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – AviD
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

There are two type of filter in wireshark:

  1. Display Filter
  2. Capture Filter

Display filter is filter introduced by wireshark. It's user friendly, powerful and many things to filter. It has modular form. For example,filter to display HTTP Post is:


Wireshark loads packet first, and then apply display filter. So it is applied in user mode.

Capture filter is filter introduced by Libpcap/Winpcap (a driver to capture packets independent of operating system). It's very restricted and hard to read and write! No modularity. But instead, it is applied to Libpcap/Winpcap;it means kernel mode. So it it fast and prevent memory or storage usage,because of no unwanted packet is captured.

share|improve this answer
Libpcap filter syntax may not be user friendly, but on a busy interface, you probably need to learn it if you don't want to deal with huge capture files. – curiousguy Aug 27 '13 at 12:04

Capture filters work when the capture is taking place. It tells Wireshark which packets to capture and save to a pcap file.

Display filters works on already captured network traffic. It's simply a filter to that tells Wireshark which packets to display.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.