Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

2. Wireshark Quick Tips Filters Capture & Display Part 1 copy right 2008 www.gearbit.com [email_address]

5. Display Filters: How to Create copy right 2008 www.gearbit.com [email_address] Creating Display Filters are done very easily using Prepare A Filter. Here’s how it done. First select View, Packet Detail. This will open up the detailed view of the packet. Exposing all the detail within the packet.

6. Display Filters: How To Create copy right 2008 www.gearbit.com [email_address] A. Then Right Mouse Click within the packet detail. A menu will open and select Prepare a Filter & Select. B. What area you have selected within the detail of the packet will be shown in the Filter Window. In this example I have chosen Address Resolution Protocol and the results are show as an arp (see B)

9. Display Filters: From the Menu copy right 2008 www.gearbit.com [email_address] A. From the Analyze Menu select Display Filters B. The Expression option reveals more Expressions, scroll down till you find what you’re looking for.

10. Display Filters: Used In Real Time copy right 2008 www.gearbit.com [email_address] You can use Display Filters in real time to show specific items of interest. The example we’re using an http filter to display only http packets in real time. Any Display Filter can be used.

11. Display Filters: Within Charts & Graphs copy right 2008 www.gearbit.com [email_address] Here Display Filters are used to show traffic patterns. Using the IO Graphs found under Statistics Menu, Statistics>IO Graphs. Then putting the desired display filter (protocol, IP address, est.) Note: Make sure to change the Units under Y Axis to Bits/Tick