Creating an ethernet capture filter

Question

I am new to wireshark filtering. I didn't found any serious wireshark filtering tutorial. I want to create a capture filter every frames sent by 192.168.1.100 to 192.168.1.44 by Ethernet using http protocol.

I tried:

http eth source 192.168.1.100 dest 192.168.1.44

Yet, It didn't worked and was turn to red. CCan you help me write this command? If you have any link about a serious wireshark filtering commands I would be ery glad to hear about it!

Answer 1

As the capture filter is "executed" by the libpcap/WinPcap/NPcap module, the documentation (not exactly a tutorial) is here, not at the Wireshark wiki.

In your case, the correct syntax would be ip and src host 192.168.1.100 and dst host 192.168.1.44 and tcp port 80, where ip is a shortcut for ether proto ip.

Beware - in Qt version of Wireshark (the default one since 2.0.x), you have to choose an interface before starting to fill in the capture filter field, otherwise the field will be red even if the syntax is correct.