The filtering capabilities of Wireshark are very comprehensive. You can filter on just about any field of any protocol, even down to the HEX values in a data stream. Sometimes though, the hardest part about setting a filter in Wireshark is remembering the syntax! So below are the top 10 display filters that I use in Wireshark. Please comment below and add any common ones that you use as well.
thatguy wrote:Does wireshark read packets before they reach the kernel/iptables?Yes.thatguy wrote:I had iptables set up to block everything, yet wireshark continued to get up to several hundred packets per second, mostly ARP broadcast from the lan.Expected behaviour.