Chapter 6: Capture Filters

Capture filters are essential to packet analyis. Taking an unfiltered trace is like putting your mouth on a firehose of information...unless you are very experienced you aren't going to be able to isolate your problem. By crafting very specific capture filters, you can tell the analyzer to capture only the traffic you are interested in.

Enter capture filters on the Start/Capture dialog window. You can chain simple filters together with logical expressions ("and", "or", "not") and parenthesis ("(",")") to build much more elaborate filters.

Simple Filters:

port 25  - capture all mail (smtp) traffic

icmp - capture just icmp traffic

tcp - capture just tcp traffic

ip host 205.152.0.20 - just traffic to/from 205.152.0.20

net 205.152 - traffic to/from 205.152.*.*

Complex Filters:

tcp and port 25 - capture *TCP* traffic with src/dst port 25

port 25 and ip host 205.152.0.20 - capture all mail traffic to/from a specific host

port 25 and not ip host 192.168.0.200 - capture all mail traffic which is NOT destined to the local mail server (ideal with detecting systems infected with spam malware)

port 445 and not dst net 192.168 - capture virus activity which is generating port scans *outside* the local network (e.g. onto the Internet)