3

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?

2
  • 1
    Kyle's answer is correct. If you ever do need to use the display filter again, frame.len would be a better choice. "frame" is guaranteed to match every packet. The "data" dissector is usually only called as a last resort, and may not match very many packets. Feb 5, 2010 at 19:47
  • cool, thanks for the info. I'll use frame.len from now on.
    – oz10
    Feb 8, 2010 at 14:58

2 Answers 2

5

As you said in your comment:

greater <length>
less <length>

They also happen to be in this handy tcpdump cheat sheet I have on my wall.

1

Wireshark uses the same capture filter syntax as tcpdump, and it doesn't look like that's an option

2
  • +1 for the link to the documentation... but you missed the "greater" option. Apparently, there is also a "len" option.
    – oz10
    Feb 5, 2010 at 17:21
  • Wow, yup. You're entirely correct- I was reading it looking for "size" and totally missed "len." Lame :-)
    – mfinni
    Feb 5, 2010 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .