CaptureFilters An overview of the capture filter syntax can be found in the User's Guide. A complete reference can be found in the expression section of the pcap-filter(7) manual page. Wireshark uses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library. If you need a capture filter for a specific protocol, have a look for it