Revision history [back]

You get back to the start screen by closing the capture file. Click on File > Close, or click on the Close icon on the toolbar, which is the seventh icon from the left, the one with a big X through it, or press Ctrl-W.

To apply a capture filter and start capturing:

If you're on the start screen, enter the capture filter in the field labeled "Capture ...using this filter:" Make sure it turns green, which indicates that your syntax is valid. Start the capture by double-clicking the interface you want to capture on, or by single-clicking the interface to select it, and then clicking the "Start capture" icon in the toolbar, the blue sharkfin icon.

If you don't see the start screen because you have packets loaded into Wireshark, then you can close the capture file to get to the start screen and then use the procedure above, or you can click on the "Capture options" icon, the fourth one from the left, and then you can select your interface and enter your capture filter on that page, and click Start.

I recommend you get familiar with what all the toolbar icons do. Hover your mouse over an icon, and a tooltip will pop up up with a brief explanation.