Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?

share|improve this question
Kyle's answer is correct. If you ever do need to use the display filter again, frame.len would be a better choice. "frame" is guaranteed to match every packet. The "data" dissector is usually only called as a last resort, and may not match very many packets. – Gerald Combs Feb 5 '10 at 19:47
cool, thanks for the info. I'll use frame.len from now on. – paxos1977 Feb 8 '10 at 14:58
up vote 5 down vote accepted

As you said in your comment:

greater <length>
less <length>

They also happen to be in this handy tcpdump cheat sheet I have on my wall.

share|improve this answer

Wireshark uses the same capture filter syntax as tcpdump, and it doesn't look like that's an option

share|improve this answer
+1 for the link to the documentation... but you missed the "greater" option. Apparently, there is also a "len" option. – paxos1977 Feb 5 '10 at 17:21
Wow, yup. You're entirely correct- I was reading it looking for "size" and totally missed "len." Lame :-) – mfinni Feb 5 '10 at 18:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.