Hi, EveryOne!
Let say i have a default profile and i want to create a new profile to capture only #DNS_TRAFFIC !
Question :: without retyping MANUALYY the dns filter expression or click on a button, is it possible to capture automatically the the traffic from all profiles once the capture process is starting on the interface!
Best Regards
The profile does not determine your capture filter.
i feel like it's more clear now. my question was if it is possible to save the filter in a profile so if i switch between profiles i will find the traffic filtered rather then manually retype the BIG* filter *expression! i can use now buttons as Exemple to save time. Right??
You can save your display filter expressions as buttons if that is what you mean. Just type in the filter and press the + next to the filter field. You can also create a menu to group different display filters by using the label format:
Group1//Filter3
Group2//Filter1
This will create two menues with each of 3 filters. The filters will be only available in the current profile.
Asked: 2021-03-07 11:52:59 +0000
Seen: 1,218 times
Last updated: Mar 08 '21
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
You want to be able to automatically capture the traffic from all profiles? What does that mean?
You can run Wireshark from the command-line (in a script or shortcut if it's easier) and specify any options you want, including the interface to capture on (
-i <interface>), the profile to use (-C <configuration profile>), the capture filter to apply (-f <capture filter>), dissector options (-o <preference/recent setting>) and more. I'm not sure if that's what you're looking for? Refer to the Wireshark man page for more details on the command-line options.Do you really want Wireshark to capture only DNS? A capture is different from a display filter. - The capture filter will only allow DNS packets into the buffer. Basically, all packets that don't match your capture filter are discarded and there is no way to go back and retrieve them. - The display filter will display on DNS packets in your packet capture
Answer to capture filter is to create a Wireshark shortcut with the startup options you need.