Display filters are used to define expressions that decide which packets get displayed, and which not in Wireshark’s packet list.

Berkeley Packet Filter (BPF) expressions decide which packets get captured, and which not when Wireshark is capturing traffic.

Both expression types have a different syntax.

Wireshark release 4.4 brings a new feature to convert display filter expressions to BPF expressions.

Type your display filter expression into the display filter box, and then select this menu entry: Edit / Copy / Display filter as pcap filter.

The capture filter expression is put on the clipboard:

tcp dst port 443

If Wireshark can not convert an expression, the menu option will be grayed-out:

 

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.