Working with captured packets
6.2. Filtering packets while viewing
Ethereal has two filtering languages: One used when capturing packets, and one used when display-
ing packets. In this section we explore that second type of filter: Display filters. The first one has already been dealt with in Section 4.8, “Filtering while capturing”.
Display filters allow you to concentrate on the packets you are interested in while hiding the cur- rently uninteresting ones. They allow you to select packets by:
•Protocol
•The presence of a field
•The values of fields
•A comparison between fields
•... and a lot more!
To select packets based on protocol type, simply type the protocol you are interested in in the Filter: field in the filter toolbar of the Ethereal window and press enter to initiate the filter. Figure 6.6, “Filtering on the TCP protocol” shows an example of what happens when you type tcp in the filter field.
Note!
All protocol and field names are entered in lowercase. Also, don't forget to press enter after entering the filter expression.
Figure 6.6. Filtering on the TCP protocol
103
