Two filter languages, and everyone mixes them up

5 min read

Wireshark has two completely separate filter syntaxes, and typing one into the other's box is the number-one reason a filter "does not work".

Capture filters (BPF) are set before you start, decide what reaches the disk at all, and are destructive — what they drop is gone. host 192.168.1.42, tcp port 443, not port 22.

Display filters are set after, in the big bar at the top, and only change what you are looking at — the capture underneath is untouched. ip.addr == 192.168.1.42, tcp.port == 443, !(tcp.port == 22). This is the one you live in.

The rule is capture wide, filter narrow: start with no capture filter, then carve the view down. You cannot filter your way back to a packet you refused to record.

The display bar colours as you type — green valid, red syntax error, yellow valid-but-suspicious. Yellow almost always means the != trap: ip.addr != x reads as "some address field is not x", and every packet has two, so it matches everything. Always write !(ip.addr == x).