I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?

  • 1
    Kyle's answer is correct. If you ever do need to use the display filter again, frame.len would be a better choice. "frame" is guaranteed to match every packet. The "data" dissector is usually only called as a last resort, and may not match very many packets. – Gerald Combs Feb 5 '10 at 19:47
  • cool, thanks for the info. I'll use frame.len from now on. – paxos1977 Feb 8 '10 at 14:58

As you said in your comment:

greater <length>
less <length>

They also happen to be in this handy tcpdump cheat sheet I have on my wall.

| improve this answer | |

Wireshark uses the same capture filter syntax as tcpdump, and it doesn't look like that's an option

| improve this answer | |
  • +1 for the link to the documentation... but you missed the "greater" option. Apparently, there is also a "len" option. – paxos1977 Feb 5 '10 at 17:21
  • Wow, yup. You're entirely correct- I was reading it looking for "size" and totally missed "len." Lame :-) – mfinni Feb 5 '10 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.