We can apply the capture filter to capture only the CDP & LOOP (for this example, I will capture all three):Īfter the capture is complete, we can save it & then we can apply different display filters to view the packets of our interest.Į.g. I will first capture the traffic on link b/w R1 & R2 using the capture filters and then we will analyse the captured traffic using different display filters:īoth links are admin down, so there is no capture at the moment:Īs soon as I enable the interfaces, we will see ‘ARP’, ‘LOOP’ & ‘CDP’. Here we do the full dissection of packets.īelow is an example where we have two atech Routers. These are also useful when the capture filters were not used while capturing the traffic from wire. It decreases the amount of data to be saved because full dissection of packets has not been done yet.Īfter Capture is complete on a link using capture filter, we can use display filters to further refine what information we want to see & analyze. With the use of capture filters, only those packets are captured which are defined in the rules of Capture filter. For capture filters wireshark uses a special methodology call BPF syntax which runs in the kernel. It has two types of filters:Ī capture filter is used to select which packets should be saved to disk while capturing. Wireshark uses Filters to capture & display the packets. Such tools were available in the past as well but they were very expensive and proprietary because they were mostly on dedicated hardware (same as OTDR and Spectrum Analysers are on dedicated HW till date). Wireshark or such SW tools are not something very new. It is like a measuring meter or device to find and examine what is going on inside a network cable or port just like a multimeter is used by an electrician to examine what is going on inside an electric cable … but of course at much deeper level.

Wireshark is the most useful & popular tool for packet Level deep Network Analysis & Troubleshooting.

Wireshark capture only http