This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Behaviour when no capture filters are defined.

0

Question: If I delete all Capture Filters from Wireshark and then start a Capture session, will Wireshark log all network interactions or none at all?

Thanks

asked 12 Mar '13, 13:22

John%20Goldorak's gravatar image

John Goldorak
6●1●1●2
accept rate: 0%

One Answer:

1

It will capture everything. Filters mean "leave something out", so if there's no filter, Wireshark will capture it all.

Hint: why ask when you can just try? Run Wireshark, start a capture without a filter, check out what the result is. Easy.

answered 12 Mar '13, 13:40

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

How would you know it captured everything? You can't see missing packets :-)

(12 Mar '13, 16:17) grahamb ♦

at least you could see the drop count and know that it didn't ;-)

Drops at SPAN port etc. are another story though...

(12 Mar '13, 16:26) Jasper ♦♦

Thanks Jasper. That's what I thought. I did try it and notice the same behaviour but I wasn't sure if something (not immediately apparent) would be left out.

I appreciate the time that you took to answer my question. Thank you.

(13 Mar '13, 07:56) John Goldorak

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(13 Mar '13, 08:00) grahamb ♦

@John Goldorak: sure, no problem - in that case verification makes sense. Keep asking and we'll try to help :-)

(13 Mar '13, 08:29) Jasper ♦♦