[Wireshark 4.4: Converting Display Filters to BPF Capture Filters](/forums/diary/Wireshark+44+Converting+Display+Filters+to+BPF+Capture+Filters/31224/)=======================================================================================================================================================* * [](http://www.facebook.com/sharer.php?u=https%3A%2F%2Fisc.sans.edu%2Fforums%2Fdiary%2F31224 ‘Share on Facebook’)* [](http://twitter.com/share?text=Wireshark%204.4%3A%20Converting%20Display%20Filters%20to%20BPF%20Capture%20Filters&url=https%3A%2F%2Fisc.sans.edu%2Fforums%2Fdiary%2F31224&via=SANS_ISC ‘Share on Twitter’) **Published** : 2024-09-01. **Last Updated** : 2024-09-01 14:56:40 UTC **by** [Didier Stevens](/handler_list.html#didier-stevens) (Version: 1) [0 comment(s)](/diary/Wireshark+44+Converting+Display+Filters+to+BPF+Capture+Filters/31224/#comments) Display filters are used to define expressions that decide which packets get displayed, and which not in Wireshark’s packet list.Berkeley Packet Filter (BPF) expressions decide which packets get captured, and which not when Wireshark is capturing traffic.Both expression types have a different syntax.Wireshark release 4.4 brings a new feature to convert display filter expressions to BPF expressions.Type your display filter expression into the display filter box, and then select this menu entry: Edit / Copy / Display filter as pcap filter.The capture filter expression is put on the clipboard:> tcp dst port 443If Wireshark can not convert an expression, the menu option will be grayed-out:Didier Stevens Senior handler [blog.DidierStevens.com](http://blog.DidierStevens.com) Keywords:[0 comment(s)](/diary/Wireshark+44+Converting+Display+Filters+to+BPF+Capture+Filters/31224/#comments)
Related Tags:
NAICS: 519 – Web Search Portals
Libraries
Archives
Other Information Services
NAICS: 541 – Professional
Scientific
Technical Services
NAICS: 518 – Computing Infrastructure Providers
Data Processing
Web Hosting
Related Services
NAICS: 51 – Information
Blog: SANS Internet Storm Center
Native API
Associated Indicators: