I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency… is there a way to do it?
With wireshark how can I filter by packet size
packet-capturewireshark
Related Topic
- Wireshark Display Filter protocol==TLSV1? (and PacketLength)
- WireShark – Capturing Packets on Multiple IP Address (FIlter)
- Wireshark filter to only capture Incoming Packets
- Incoming Outgoing Packets Wireshark
- Wireshark – Can Wireshark Capture an Entire Ethernet Frame Including Preamble, CRC, and Interframe Spacing?
- How to create a packet capture file on a headless server for a single process
- How to easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark
- Wireshark under Windows: Any way to capture packets before dropped by special filter drivers
Best Answer
As you said in your comment:
They also happen to be in this handy tcpdump cheat sheet I have on my wall.