Unfortunately, they are not interchangeable, however they are not difficult and there are many “cheat sheets” out there that can help you, especially if you are not using them on a daily basis. There are two types of filters in Wireshark capture filters and display filters. It is not an exhaustive list but rather some of my “go to’s” In this article I will go through some of the basic filters I use regularly in Wireshark. Wireshark has a multitude of sample captures if you want to step up your packet capture foo. Either way, I win because the problem is solved which is all I really want. They fix the problem and tell me they did nothing. Usually I send them a PCAP with the pertinent info, a doc explaining my theory and two things happen 1. Most of the times, I use it as a tool to show how it is NOT my fault, rather the other side’s.

Sniffer apps such as Sniffer Pro, TCPDump, and Wireshark have been paramount for my success in the field. I have a motto I have lived by in my network years, “When in doubt, sniff it out”. OK maybe not but it does show a level of knowledge on the end user if they in fact have Wireshark. When I am working with someone on a GTM or a Zoom type solution and I ask, “Do you have Wireshark installed on your computer”, if they tell me no, I am immediately suspect.

Wireshark capture filter ip address