Working with captured packets
As you might have noticed, only packets of the TCP protocol are displayed now (e.g. packets
Note!
When using a display filter, all packets remain in the capture file. The display filter only changes the display of the capture file but not its content!
You can filter on any protocol that Ethereal understands. You can also filter on any field that a dis- sector adds to the tree view, but only if the dissector has added an abbreviation for the field. A list of such fields is available in the Ethereal in the Add Expression... dialog box. You can find more in- formation on the Add Expression... dialog box in Section 6.4, “The "Filter Expression" dialog box”.
For example, to narrow the packet list pane down to only those packets to or from the IP address 192.168.0.1, use ip.addr==192.168.0.1.
Note!
To remove the filter, click on the Clear button to the right of the filter field.
104
