In this video, I respond to a question from one of my readers who wanted to create a display filter for many IP addresses. In either case, you will need to use a display filter to narrow the traffic down. Even when you have a capture filter, it may be too generic.

You may not know what to focus on when you capture packets, resulting in no capture filter. A display filter is configured after you have captured your packets. A capture filter is configured prior to starting your capture and affects what packets are captured. Note that in Wireshark, display and capture filter syntax are completely different. In this video, I review the two most common filters in Wireshark. If you're running multiple clients it's helpful to keep track of what each one is for.One of the keys to being an effective network troubleshooter when using a protocol analyzer is the ability to see patterns, which is where filters come into play. Description - Not a required field but allows you to enter some details about the client.Password - Enter the password associated with the username above.Username - Enter your DynDNS username here, or the username for the service you are going to use.So for my example, would still resolve to my public address. If you enable it then it allows users to type. Wildcards - My personal preference is to leave this unchecked.MX - This can be left blank unless you plan on configuring your subdomain for email routing.Hostname - In this field, you need to enter the full hostname that you created in the DynDNS account you set up earlier.Interface to monitor - Most users will select WAN here unless you have multiple WAN interfaces.Service type - Choose DynDNS here unless you created an account with one of the other providers.Below is an explanation of each of the settings on the configuration page.

Wireshark ip address filter wildcard