I have a Wireshark 2.6.2. This is a great tool except that it is not intuitive how to go back to the start screen once I finished a capture. I always have to restart the program. Also it is not intuitive how to apply a capture filter. I can manage the filter but don't know how to start the capture from there.
You get back to the start screen by closing the capture file. Click on File > Close, or click on the Close icon on the toolbar, which is the seventh icon from the left, the one with a big X through it, or press Ctrl-W.
To apply a capture filter and start capturing:
If you're on the start screen, enter the capture filter in the field labeled "Capture ...using this filter:" Make sure it turns green, which indicates that your syntax is valid. Start the capture by double-clicking the interface you want to capture on, or by single-clicking the interface to select it, and then clicking the "Start capture" icon in the toolbar, the blue sharkfin icon.
If you don't see the start screen because you have packets loaded into Wireshark, then you can close the capture file to get to the start screen and then use the procedure above, or you can click on the "Capture options" icon, the fourth one from the left, and then you can select your interface and enter your capture filter on that page, and click Start.
I recommend you get familiar with what all the toolbar icons do. Hover your mouse over an icon, and a tooltip will pop up up with a brief explanation.
Note that when setting a capture filter you should select the interface(s) from the list first (yes, you can capture from multiple interfaces at the same time) and then enter the capture filter. This is because if you do it the other way, changing the interface selection removes the capture filter.
Asked: 2018-07-27 16:38:16 +0000
Seen: 4,785 times
Last updated: Jul 27 '18
