ethereal-filter - Ethereal filter syntax and reference
ethereal [other options] [ -R ``filter expression'' ]
tethereal [other options] [ -R ``filter expression'' ]
Ethereal and Tethereal share a powerful filter engine that helps remove the noise from a packet trace and lets you see only the packets that interest you. If a packet meets the requirements expressed in your filter, then it is displayed in the list of packets. Display filters let you compare the fields within a protocol against a specific value, compare fields against fields, and check the existence of specified fields or protocols.
Filters are also used by other features such as statistics generation and packet list colorization (the latter is only available to Ethereal). This manual page describes their syntax and provides a comprehensive reference of filter fields.
The simplest filter allows you to check for the existence of a protocol or field. If you want to see all packets which contain the IPX protocol, the filter would be ``ipx'' (without the quotation marks). To see all packets that contain a Token-Ring RIF field, use ``tr.rif''.
Think of a protocol or field in a filter as implicitly having the ``exists'' operator.
Note: all protocol and field names that are available in Ethereal and Tethereal filters are listed in the FILTER PROTOCOL REFERENCE (see below).