tshark capture filter for len parameter

From your comment on @joemc's answer it turns out you mean the length of the TCP payload. In a display filter this is available as "tcp.len==0", so if you don't want to see TCP frames with no payload, then you can use "tcp.len>0"

But you are looking for a capture filter, this is a little more complicated. This is because there is no field in the TCP header for the payload length. There is only a field for the length of the TCP header. However, in the IP header, there is a field "total length", which includes the length of the IP header and the IP payload (which is off course the sum of TCP header length and TCP payload length).

In short "IP total length = IP header length + TCP header length + TCP payload length" which results in:

TCP payload length = IP total length - IP header length - TCP header length

Now we need to create capture filters for each part:

IP total length ==> ip[2:2]
IP header length ==> (ip[0]&0x0f) << 2
TCP header length ==> (tcp[12]&0xf0) >> 2

Resulting in a capture filter of:

ip[2:2] - ((ip[0]&0x0f) << 2) - ((tcp[12]&0xf0) >> 2) > 0