
Network Analysis using Wireshark Cookbook
By :

In order to configure display filters, you can choose one of the several options:
Choosing from the filters menus
Writing the syntax directly into the display filter window (while working with Wireshark; after a while this will become your favorite)
Choosing a parameter in the packet pane and defining it as a filter
Using tshark
or wireshark
with command line ; this will be discussed in Appendix
This chapter discusses the first three options.
In general, a display filter string takes the form of a series of primitive expressions connected by conjunctions (and, or, or something else) and optionally preceded by not
:
[not] Expression [and|or] [not] Expression...
While Expression
can be any filter expression, such as ip.src==192.168.1.1
for the source address, tcp.flags.syn==1
for TCP SYN flag presence, and tcp.analysis.retransmission
for TCP retransmissions, and|or
are conjunctions that can be used in any combinations of expression, including brackets, multiple...
Change the font size
Change margin width
Change background colour