filters

Overview

A busy network produces overwhelming volumes of packets. Filters are how you cut through the noise to find the traffic that matters. This lesson explains the two kinds of filters in packet analysis and how to use them effectively.

Learning objectives

• Distinguish capture filters from display filters.
• Write basic filter expressions conceptually.
• Use filters to isolate traffic of interest.

Core concept

Packet analysis uses two distinct filter types (Wireshark terminology, with tcpdump using capture-style filters):

• Capture filters — applied while capturing, they decide which packets are recorded at all. They keep captures small and focused, but discarded packets are gone. (These use BPF syntax, e.g. host 10.0.0.5 or port 443.)
• Display filters — applied after/while viewing a capture, they decide which recorded packets are shown, without discarding anything. Far more expressive (e.g. http.request.method == "POST" or tcp.port == 443 && ip.addr == 10.0.0.5).

How it works

Use a capture filter when you know in advance what you care about and want to limit volume (e.g. only traffic to one host). Use a display filter to explore a full capture flexibly — narrowing to a protocol, a conversation, or a specific field — while retaining every packet in case you need to widen the view again. The two syntaxes differ: capture filters are simpler (BPF), display filters are richer and protocol-field-aware.

Practical example

Troubleshooting a web problem to a specific server, you might:

• Capture filter: host 203.0.113.10 and port 443 — record only HTTPS traffic to that server, keeping the file small.
• Display filter (in Wireshark): tls.handshake.type == 1 — from the capture, show only TLS "Client Hello" packets to inspect how sessions begin.

The capture filter limited what was saved; the display filter zoomed in on what to look at.

Cybersecurity relevance

Filtering is essential to real analysis: hunting for indicators (traffic to a suspicious IP, DNS queries for a known-bad domain, unusual ports) means isolating a few relevant packets from millions. Skilled use of display filters lets an analyst quickly confirm or rule out a hypothesis during incident response. Poor filtering either drowns you in noise or, with an over-narrow capture filter, silently discards evidence you later need.

Common mistakes

• Confusing capture and display filters — capture filters drop packets permanently; display filters only hide them.
• Over-restricting the capture filter, discarding packets you later wish you had.
• Using the wrong syntax — capture (BPF) and display filter grammars are different.

Key takeaways

• Capture filters decide what gets recorded (BPF syntax, permanent); display filters decide what is shown from a capture (richer, non-destructive).
• Capture-filter when volume must be limited up front; display-filter to explore a full capture flexibly.
• Effective filtering isolates the few relevant packets from massive volumes — central to troubleshooting and threat hunting.

Check your understanding

• What is the key practical difference between a capture filter and a display filter?
• When is it safer to use a broad capture with display filters rather than a narrow capture filter?