What is the difference between a Wireshark Capture Filter (BPF) and a Display Filter?

A Capture Filter uses libpcap/Berkeley Packet Filter (BPF) syntax (such as 'tcp port 443 and host 10.0.0.5') and discards non-matching packets at the OS kernel driver level before they are recorded. A Display Filter uses Wireshark's rich protocol dissector syntax (such as 'tls.handshake.type == 1 && ip.addr == 10.0.0.5') to hide or show packets non-destructively within an already captured PCAP.

Why should I avoid using 'ip.addr != x.x.x.x' in Wireshark display filters?

Every IP packet contains two IP addresses (ip.src and ip.dst). The expression 'ip.addr != 10.0.0.1' evaluates to true if EITHER the source OR destination IP is not 10.0.0.1—which matches almost every packet. Always use '!(ip.addr == 10.0.0.1)' to exclude traffic to and from a host.

How do I filter for TCP SYN scans in Wireshark and tcpdump?

In Wireshark, use 'tcp.flags.syn == 1 and tcp.flags.ack == 0' to view initial connection attempts without ACK replies. In tcpdump BPF syntax, use 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn' or 'tcp[13] == 2' to match packets where only the SYN bit (bit 1, value 2) is set in byte 13 of the TCP header.

How can I inspect HTTPS domains in Wireshark when traffic is encrypted?

Even in TLS 1.3 with encrypted certificates, the initial TLS ClientHello handshake normally includes the Server Name Indication (SNI) extension in cleartext (unless ECH is active). Filter with 'tls.handshake.extensions_server_name' in Wireshark to see every requested HTTPS hostname.

What do the tcpdump flags -nn, -s0, and -vvv do?

The -nn flag disables both DNS hostname lookups and port-to-service name translation for faster, unambiguous output; -s0 sets the snaplen to 0 (capturing the full packet payload rather than truncating at 68/96 bytes); and -vvv enables maximum protocol decoding verbosity.

Cybersecurity

Wireshark Display Filter & tcpdump BPF Capture Syntax Builder (2026)

Construct exact Wireshark display filters and matching tcpdump Berkeley Packet Filter (BPF) CLI commands for SYN scans, ARP spoofing, TLS handshakes, DNS tunneling, and HTTP anomalies.Documentation & FAQs ↓

Wireshark Display Filter & tcpdump BPF Syntax Builder — Interactive Console

Runs locally in your browser • Instant output

Source IP / CIDR

Destination IP / CIDR

Port Number

Protocol

TCP Header Flags

HTTP Method

HTTP Status

Payload Contains String

Exclude SSH (Port 22) & RDP (Port 3389) Management Traffic Noise

Wireshark Display Filter

tcp && ip.src == 10.10.14.22 && ip.dst == 192.168.1.0/24 && tcp.port == 443 && tcp.flags.syn == 1 && frame contains "password" && !(tcp.port == 22 || tcp.port == 3389)

tcpdump BPF CLI Command

$ sudo tcpdump -i any -nn -v -s0 'tcp and src host 10.10.14.22 and dst net 192.168.1.0/24 and port 443 and (tcp[tcpflags] & (tcp-syn) != 0) and not port 22 and not port 3389' -A | grep -i --color "password"

Ready

Embed / Cite This Tool (Markdown & HTML)

GitHub / Reddit Markdown Badge

[![Wireshark Display Filter & tcpdump BPF Syntax Builder](https://img.shields.io/badge/ZerosUniverse-Free_Tool-ff6a00)](https://www.zerosuniverse.com/tools/wireshark-tcpdump-filter-builder/)

Blog / Documentation HTML Citation

<a href="https://www.zerosuniverse.com/tools/wireshark-tcpdump-filter-builder/">Wireshark Display Filter & tcpdump BPF Syntax Builder — ZerosUniverse</a>

2026 Wireshark Display Filter vs tcpdump BPF Capture Syntax Table

2026 Verified Reference

Quick Answer & 2026 Technical Summary (wireshark filter generator)Updated 2026 Standard

Wireshark uses two distinct filter engines: Berkeley Packet Filters (BPF, shared with `tcpdump`) filter raw packets at the kernel NIC driver before writing to disk (`host 10.0.0.5 and tcp port 443`), whereas Wireshark Display Filters parse deep Layer-7 protocol fields (`http.request.method == "POST"` or `tls.handshake.type == 1`) during post-capture analysis.

tcpdump -ni any 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn' -w syn_scan.pcap

Zero-Overhead Capture Flag: tcpdump -ni eth0 -s 0 -w capture.pcap

SYN-Only BPF Expression: tcp[13] == 2 (or tcp[tcpflags] == tcp-syn)

TLS SNI Hostname Filter: tls.handshake.extensions_server_name contains "domain"

Packet Analysis Goal	Wireshark Display Filter	tcpdump BPF Capture Filter	SOC / Network Triage Purpose
Isolate Host IP & Port	`ip.addr == 10.10.14.5 && tcp.port == 443`	host 10.10.14.5 and tcp port 443	Inspect bidirectional flow for a single endpoint
Detect TCP SYN Port Scans	tcp.flags.syn == 1 && tcp.flags.ack == 0	`tcp[tcpflags] & (tcp-syn\|tcp-ack) == tcp-syn`	Spots Nmap -sS sweeps & SYN flood DDoS bursts
Hunt HTTP POST & Auth Flows	`http.request.method == "POST" \|\| http.response.code >= 400`	tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)	Extracts form logins, API calls & 4xx/5xx errors
Inspect TLS ClientHello & SNI	`tls.handshake.type == 1 && tls.handshake.extensions_server_name`	tcp port 443 and (tcp[((tcp[12]&0xf0)>>2)] = 0x16)	Identifies destination domain names inside HTTPS
Audit DNS Queries & AXFR	`dns.flags.response == 0 \|\| dns.qry.type == 252`	port 53	Detects C2 DNS tunneling & zone transfer attempts
Exclude Your Own SSH Session	!(tcp.port == 22 && ip.addr == 192.168.1.50)	`not (tcp port 22 and host 192.168.1.50)`	Prevents feedback loop when running remote tcpdump

Step-by-Step Workflow

4 Easy Steps

01Phase 1

Choose a Threat Preset or Custom Protocol

Select a pre-built detection profile (e.g., Nmap SYN Scan, TLS ClientHello SNI, ARP Duplicate IP) or pick TCP, UDP, ICMP, DNS, HTTP, TLS, or SMB.

02Phase 2

Specify Source/Destination IPs, Subnets & Ports

Enter host IPs, CIDR blocks, and port numbers, and choose directional operators (Source, Destination, or Either).

03Phase 3

Configure TCP Flags & Payload Match Conditions

Toggle SYN, ACK, FIN, RST, PSH, or URG bits and optional payload substring/hex filters (frame contains).

04Phase 4

Copy Wireshark Filter, tcpdump, or tshark CLI

Paste the Display Filter directly into Wireshark's filter bar or run the generated tcpdump/tshark command on your Linux sensor.

Real-World Applications

PCAP Forensics & Incident Response

Isolate command-and-control beaconing, TLS Server Name Indication (SNI) domains, and lateral movement flows inside multi-gigabyte packet captures.

Production Server Packet Capture (tcpdump)

Craft precise kernel BPF capture filters (-nn -s0 -w) on headless Linux servers so only relevant packets are written to disk during live troubleshooting.

CEH Module 08 & Blue Team Certification Prep

Master the syntax differences between capture-time Berkeley Packet Filters (BPF) and post-capture Wireshark protocol dissectors.

Related Editorial GuideCEH Module 08: Packet Sniffing & Wireshark Analysis Guide

Read Tutorial →

Help Your Network

Found this tool helpful? Share it with colleagues:

100% free, private browser utility with zero server uploads. Spread the word!

Wireshark Display Filter & tcpdump BPF Capture Syntax Builder (2026)

2026 Wireshark Display Filter vs tcpdump BPF Capture Syntax Table

Step-by-Step Workflow

Choose a Threat Preset or Custom Protocol

Specify Source/Destination IPs, Subnets & Ports

Configure TCP Flags & Payload Match Conditions

Copy Wireshark Filter, tcpdump, or tshark CLI

Real-World Applications

PCAP Forensics & Incident Response

Production Server Packet Capture (tcpdump)

CEH Module 08 & Blue Team Certification Prep

Architectural Capabilities

Dual Wireshark Display + tcpdump BPF Engine

TCP Flag Bitmask & Handshake Selector

SOC Threat Hunting & Attack Presets

tshark Field Extraction Command Generator

CEH Module 08: Packet Sniffing & Wireshark Analysis Guide

Found this tool helpful? Share it with colleagues: