up vote 1 down vote favorite
share [g+] share [fb]

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?

link|improve this question
1  
Kyle's answer is correct. If you ever do need to use the display filter again, frame.len would be a better choice. "frame" is guaranteed to match every packet. The "data" dissector is usually only called as a last resort, and may not match very many packets. – Gerald Combs Feb 5 '10 at 19:47
cool, thanks for the info. I'll use frame.len from now on. – ceretullis Feb 8 '10 at 14:58
feedback

2 Answers

up vote 4 down vote accepted

As you said in your comment:

greater <length>
less <length>

They also happen to be in this handy tcpdump cheat sheet I have on my wall.

link|improve this answer
feedback
up vote 1 down vote

Wireshark uses the same capture filter syntax as tcpdump, and it doesn't look like that's an option

link|improve this answer
+1 for the link to the documentation... but you missed the "greater" option. Apparently, there is also a "len" option. – ceretullis Feb 5 '10 at 17:21
Wow, yup. You're entirely correct- I was reading it looking for "size" and totally missed "len." Lame :-) – mfinni Feb 5 '10 at 18:05
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.