summaryrefslogtreecommitdiffstats
path: root/docbook/wsug_src/wsug_capture.adoc
diff options
context:
space:
mode:
Diffstat (limited to 'docbook/wsug_src/wsug_capture.adoc')
-rw-r--r--docbook/wsug_src/wsug_capture.adoc733
1 files changed, 733 insertions, 0 deletions
diff --git a/docbook/wsug_src/wsug_capture.adoc b/docbook/wsug_src/wsug_capture.adoc
new file mode 100644
index 00000000..c7ef8f1b
--- /dev/null
+++ b/docbook/wsug_src/wsug_capture.adoc
@@ -0,0 +1,733 @@
+// WSUG Chapter Capture
+
+[#ChapterCapture]
+
+== Capturing Live Network Data
+
+[#ChCapIntroduction]
+
+=== Introduction
+
+Capturing live network data is one of the major features of Wireshark.
+
+The Wireshark capture engine provides the following features:
+
+* Capture from different kinds of network hardware such as Ethernet or 802.11.
+
+* Simultaneously capture from multiple network interfaces.
+
+* Stop the capture on different triggers such as the amount of captured data,
+ elapsed time, or the number of packets.
+
+* Simultaneously show decoded packets while Wireshark is capturing.
+
+* Filter packets, reducing the amount of data to be captured. See
+ <<ChCapCaptureFilterSection>>.
+
+* Save packets in multiple files while doing a long-term capture, optionally
+ rotating through a fixed number of files (a “ringbuffer”). See
+ <<ChCapCaptureFiles>>.
+
+The capture engine still lacks the following features:
+
+* Stop capturing (or perform some other action) depending on the captured data.
+
+[#ChCapPrerequisitesSection]
+
+=== Prerequisites
+
+Setting up Wireshark to capture packets for the first time can be
+tricky. A comprehensive guide “How To setup a Capture” is available at
+{wireshark-wiki-url}CaptureSetup.
+
+Here are some common pitfalls:
+
+* You may need special privileges to start a live capture.
+
+* You need to choose the right network interface to capture packet data from.
+
+* You need to capture at the right place in the network to see the traffic you
+ want to see.
+
+If you have any problems setting up your capture environment, you should have a
+look at the guide mentioned above.
+
+[#ChCapCapturingSection]
+
+=== Start Capturing
+
+The following methods can be used to start capturing packets with Wireshark:
+
+* You can double-click on an interface in the <<ChCapInterfaceSection,welcome screen>>.
+
+* You can select an interface in the <<ChCapInterfaceSection,welcome screen>>, then select menu:Capture[Start] or click the first toolbar button.
+
+* You can get more detailed information about available interfaces using <<ChCapCaptureOptions>> (menu:Capture[Options...]).
+
+* If you already know the name of the capture interface you can start Wireshark from the command line:
+--
+----
+$ wireshark -i eth0 -k
+----
+--
+This will start Wireshark capturing on interface `eth0`. More details can be found at <<ChCustCommandLine>>.
+
+[#ChCapInterfaceSection]
+
+=== The “Capture” Section Of The Welcome Screen
+
+When you open Wireshark without starting a capture or opening a capture file it will display the “Welcome Screen,” which lists any recently opened capture files and available capture interfaces.
+Network activity for each interface will be shown in a sparkline next to the interface name.
+It is possible to select more than one interface and capture from them simultaneously.
+
+[#ChCapCaptureInterfacesMainWin32]
+
+.Capture interfaces on Microsoft Windows
+image::images/ws-capture-interfaces-main-win32.png[{screenshot-attrs}]
+
+[#ChCapCaptureInterfacesMainMacos]
+
+.Capture interfaces on macOS
+image::images/ws-capture-interfaces-main-macos.png[{screenshot-attrs}]
+
+Some interfaces allow or require configuration prior to capture.
+This will be indicated by a configuration icon
+(image:images/toolbar/x-capture-options.png[height=16,width=16])
+to the left of the interface name.
+Clicking on the icon will show the configuration dialog for that interface.
+
+Hovering over an interface will show any associated IPv4 and IPv6 addresses and its capture filter.
+
+Wireshark isn't limited to just network interfaces -- on most systems you can also capture USB, Bluetooth, and other types of packets.
+Note also that an interface might be hidden if it’s inaccessible to Wireshark or if it has been hidden as described in <<ChCapManageInterfacesSection>>.
+
+[#ChCapCaptureOptions]
+
+=== The “Capture Options” Dialog Box
+
+When you select menu:Capture[Options...] (or use the corresponding item in the
+main toolbar), Wireshark pops up the “Capture Options” dialog box as shown in
+<<ChCapCaptureOptionsDialog>>.
+If you are unsure which options to choose in this dialog box, leaving the defaults settings as they are should work well in many cases.
+
+[#ChCapCaptureOptionsDialog]
+.The “Capture Options” input tab
+image::images/ws-capture-options.png[{screenshot-attrs}]
+
+The “Input” tab contains the “Interface” table, which shows the following columns:
+
+Interface::
+The interface name.
++
+Some interfaces allow or require configuration prior to capture.
+This will be indicated by a configuration icon
+(image:images/toolbar/x-capture-options.png[height=16,width=16])
+to the left of the interface name.
+Clicking on the icon will show the configuration dialog for that interface.
+
+Traffic::
+A sparkline showing network activity over time.
+
+Link-layer Header::
+The type of packet captured by this interface.
+In some cases it is possible to change this.
+See <<ChCapLinkLayerHeader>> for more details.
+
+Promiscuous::
+Lets you put this interface in promiscuous mode while capturing.
+Note that another application might override this setting.
+
+Snaplen::
+The snapshot length, or the number of bytes to capture for each packet.
+You can set an explicit length if needed, e.g., for performance or privacy reasons.
+
+Buffer::
+The size of the kernel buffer that is reserved for capturing packets.
+You can increase or decrease this as needed, but the default is usually sufficient.
+
+Monitor Mode::
+Lets you capture full, raw 802.11 headers.
+Support depends on the interface type, hardware, driver, and OS.
+Note that enabling this might disconnect you from your wireless network.
+
+Capture Filter::
+The capture filter applied to this interface.
+You can edit the filter by double-clicking on it.
+See <<ChCapCaptureFilterSection>> for more details about capture filters.
+
+Hovering over an interface or expanding it will show any associated IPv4 and IPv6 addresses.
+
+If “Enable promiscuous mode on all interfaces” is enabled, the individual promiscuous mode settings above will be overridden.
+
+“Capture filter for selected interfaces” can be used to set a filter for more than one interface at the same time.
+
+btn:[Manage Interfaces] opens the <<ChCapManageInterfacesDialog>> where pipes can be defined, local interfaces scanned or hidden, or remote interfaces added.
+
+btn:[Compile Selected BPFs] opens <<ChCapCompiledFilterOutputDialog>>, which shows you the compiled bytecode for your capture filter.
+This can help to better understand the capture filter you created.
+
+
+[TIP]
+.Linux power user tip
+====
+The execution of BPFs can be sped up on Linux by turning on BPF Just In Time compilation by executing
+
+----
+$ echo 1 >/proc/sys/net/core/bpf_jit_enable
+----
+
+if it is not enabled already. To make the change persistent you can use
+link:{sysfs-main-url}[sysfsutils].
+====
+
+.The “Capture Options” output tab
+image::images/ws-capture-options-output.png[{screenshot-attrs}]
+
+The “Output” tab shows the following information:
+
+Capture to a permanent file::
+
+File:::
+This field allows you to specify the file name that will be used for the capture file.
+It is left blank by default.
+If left blank, the capture data will be stored in a temporary file.
+See <<ChCapCaptureFiles>> for details.
+You can also click on the button to the right of this field to browse through the filesystem.
+
+Output format:::
+Allows you to set the format of the capture file.
+pcapng is the default and is more flexible than pcap.
+pcapng might be required, e.g., if more than one interface is chosen for capturing.
+See {wireshark-wiki-url}Development/PcapNg for more details on pcapng.
+
+Create a new file automatically...::
+Sets the conditions for switching a new capture file.
+A new capture file can be created based on the following conditions:
+ * The number of packets in the capture file.
+ * The size of the capture file.
+ * The duration of the capture file.
+ * The wall clock time.
+
+Use a ring buffer with::
+Multiple files only.
+Form a ring buffer of the capture files with the given number of files.
+
+More details about capture files can be found in <<ChCapCaptureFiles>>.
+
+.The “Capture Options” options tab
+image::images/ws-capture-options-options.png[{screenshot-attrs}]
+
+The “Options” tab shows the following information:
+
+Display Options::
+
+Update list of packets in real-time:::
+Updates the packet list pane in real time during capture.
+If you do not enable this, Wireshark will not display any packets until you stop the capture.
+When you check this, Wireshark captures in a separate process and feeds the captures to the display process.
+
+Automatically scroll during live capture:::
+Scroll the packet list pane as new packets come in, so you are always looking at the most recent packet.
+Automatic scrolling is temporarily disabled when manually scrolling upwards or performing a <<ChUseTabGo,"Go" action>> so that the selected packet can be examined.
+It will resume upon manually scrolling to the end of the packet list.
+If you do not specify this Wireshark adds new packets to the packet list but does not scroll the packet list pane.
+This option has no effect if “Update list of packets in real-time” is disabled.
+
+Show capture information during capture:::
+If this option is enabled, the capture information dialog described in <<ChCapRunningSection>> will be shown while packets are captured.
+
+Name Resolution::
+
+Resolve MAC addresses:::
+Translate MAC addresses into names.
+
+Resolve network names:::
+Translate network addresses into names.
+
+Resolve transport names:::
+Translate transport names (port numbers).
+
+See <<ChAdvNameResolutionSection>> for more details on each of these options.
+
+Stop capture automatically after...::
+
+Capturing can be stopped based on the following conditions:
+
+* The number of packets in the capture file.
+* The number of capture files.
+* The capture file size.
+* The capture file duration.
+
+You can double click on an interface row in the “Input“ tab or click btn:[Start] from any tab to commence the capture. You can click btn:[Cancel] to apply your changes and close the dialog.
+
+[#ChCapManageInterfacesSection]
+
+=== The “Manage Interfaces” Dialog Box
+
+[#ChCapManageInterfacesDialog]
+.The “Manage Interfaces” dialog box
+image::images/ws-manage-interfaces.png[{screenshot-attrs}]
+
+The “Manage Interfaces” dialog box initially shows the “Local Interfaces” tab, which lets you manage the following:
+
+Show::
+Whether or not to show or hide this interface in the welcome screen and the “Capture Options” dialog.
+
+Friendly Name::
+A name for the interface that is human readable.
+
+Interface Name::
+The device name of the interface.
+
+Comment::
+Can be used to add a descriptive comment for the interface.
+
+// [[ChCapManageInterfacesPipesDialog]]
+
+// .The “Pipes” tab
+// image::images/ws-capture-options-manage-interfaces-pipes.png[{screenshot-attrs}]
+
+The “Pipes” tab lets you capture from a named pipe.
+To successfully add a pipe, its associated named pipe must have already been created.
+Click btn:[{plus}] and type the name of the pipe including its path.
+Alternatively, btn:[Browse] can be used to locate the pipe.
+
+To remove a pipe from the list of interfaces, select it and press btn:[-].
+
+// [[ChCapManageInterfacesDialog]]
+
+// === The “Add New Interfaces” dialog box
+
+// As a central point to manage interfaces this dialog box consists of three tabs
+// to add or remove interfaces.
+
+// .The “Add New Interfaces” dialog box
+// image::images/ws-capture-options-manage-interfaces.png[{screenshot-attrs}]
+
+// ==== Add or hide local interfaces
+
+// [[ChCapManageInterfacesLocalDialog]]
+// .The “Add New Interfaces - Local Interfaces” dialog box
+// image::images/ws-capture-options-manage-interfaces-local.png[{screenshot-attrs}]
+
+// The tab “Local Interfaces” contains a list of available local interfaces,
+// including the hidden ones, which are not shown in the other lists.
+
+// If a new local interface is added, for example, a wireless interface has been
+// activated, it is not automatically added to the list to prevent the constant
+// scanning for a change in the list of available interfaces. To renew the list a
+// rescan can be done.
+
+// One way to hide an interface is to change the preferences. If the “Hide”
+// checkbox is activated and the btn:[Apply] button clicked, the interface will
+// not be seen in the lists of the “Capture Interfaces” dialog box any more. The
+// changes are also saved in the `preferences` file.
+
+// ==== Add or hide remote interfaces
+
+// [[ChCapManageInterfacesRemoteDialog]]
+// .The “Add New Interfaces - Remote Interfaces” dialog box
+// image::images/ws-capture-options-manage-interfaces-remote.png[{screenshot-attrs}]
+
+On Microsoft Windows, the “Remote Interfaces” tab lets you capture from an interface on a different machine.
+The Remote Packet Capture Protocol service must first be running on the target platform before Wireshark can connect to it.
+
+On Linux or Unix you can capture (and do so more securely) through an SSH tunnel.
+
+To add a new remote capture interface, click btn:[{plus}] and specify the following:
+
+Host::
+The IP address or host name of the target platform where the Remote Packet Capture Protocol service is listening.
+The drop-down list contains the hosts that have previously been successfully contacted.
+The list can be emptied by choosing “Clear list” from the drop-down list.
+
+Port::
+Set the port number where the Remote Packet Capture Protocol service is listening on.
+Leave blank to use the default port (2002).
+
+Null authentication::
+Select this if you don’t need authentication to take place for a remote capture to be started.
+This depends on the target platform.
+This is exactly as secure as it appears, i.e., it is not secure at all.
+
+Password authentication::
+Lets you specify the username and password required to connect to the Remote Packet Capture Protocol service.
+
+Each interface can optionally be hidden.
+In contrast to the local interfaces, they are not saved in the `preferences` file.
+
+[NOTE]
+====
+Make sure you have outside access to port 2002 on the target platform.
+This is the default port used by the Remote Packet Capture Protocol service.
+====
+
+To remove a host including all its interfaces from the list, select it and click the btn:[-] button.
+
+// To access the Remote Capture Interfaces dialog use the “Remote Interfaces” tab of the “Manage Interfaces” dialog. See <<ChCapManageInterfacesRemoteDialog>> and select btn:[Add].
+
+// [[ChCapInterfaceRemoteDialog]]
+// .The “Remote Capture Interfaces” dialog box
+// image::images/ws-capture-options-manage-interfaces-remote-plus.png[{screenshot-attrs}]
+
+
+// ==== Remote Capture Settings
+
+// The remote capture can be further fine tuned to match your situation. The
+// btn:[Remote Interfaces] button in <<ChCapManageInterfacesDialog>> gives
+// you this option. It pops up the dialog shown in
+// <<ChCapInterfaceRemoteSettingsDialog>>.
+
+// [[ChCapInterfaceRemoteSettingsDialog]]
+// .The “Remote Capture Settings” dialog box
+// image::images/ws-capture-options-remote-settings.png[{screenshot-attrs}]
+
+// You can set the following parameters in this dialog:
+
+// _Do not capture own RPCAP traffic_::
+// This option sets a capture filter so that the traffic flowing back from the
+// Remote Packet Capture Protocol service to Wireshark isn’t captured as well and
+// also send back. The recursion in this saturates the link with duplicate traffic.
+// +
+// You only should switch this off when capturing on an interface other than the
+// interface connecting back to Wireshark.
+
+// _Use UDP for data transfer_::
+// Remote capture control and data flows over a TCP connection. This option allows
+// you to choose a UDP stream for data transfer.
+
+// _Sampling option None_::
+// This option instructs the Remote Packet Capture Protocol service to send back
+// all captured packets which have passed the capture filter. This is usually not a
+// problem on a remote capture session with sufficient bandwidth.
+
+// _Sampling option 1 of x packets_::
+// This option limits the Remote Packet Capture Protocol service to send only a sub
+// sampling of the captured data, in terms of number of packets. This allows
+// capture over a narrow band remote capture session of a higher bandwidth
+// interface.
+
+
+// _Sampling option 1 every x milliseconds_::
+// This option limits the Remote Packet Capture Protocol service to send only a sub
+// sampling of the captured data in terms of time. This allows capture over a
+// narrow band capture session of a higher bandwidth interface.
+
+// [[ChCapInterfaceDetailsSection]]
+
+// === The “Interface Details” dialog box
+
+// When you select Details from the Capture Interface menu, Wireshark pops up the
+// “Interface Details” dialog box as shown in <<ChCapInterfaceDetailsDialog>>. This
+// dialog shows various characteristics and statistics for the selected interface.
+
+// [NOTE]
+// .Microsoft Windows only
+// ====
+// This dialog is only available on Microsoft Windows
+// ====
+
+// [[ChCapInterfaceDetailsDialog]]
+// .The “Interface Details” dialog box
+// image::images/ws-capture-interface-details.png[{screenshot-attrs}]
+
+[#ChCapCompiledFilterOutputSection]
+
+=== The “Compiled Filter Output” Dialog Box
+
+This figure shows the results of compiling the BPF filter for the selected interfaces.
+
+[#ChCapCompiledFilterOutputDialog]
+
+.The “Compiled Filter Output” dialog box
+image::images/ws-capture-options-compile-selected-bpfs.png[{medium-screenshot-attrs}]
+
+In the list on the left the interface names are listed.
+The results of compiling a filter for the selected interface are shown on the right.
+
+[#ChCapCaptureFiles]
+
+=== Capture files and file modes
+
+While capturing, the underlying libpcap capturing engine will grab the packets
+from the network card and keep the packet data in a (relatively) small kernel
+buffer. This data is read by Wireshark and saved into a capture file.
+
+By default, Wireshark saves packets to a temporary file. You can also tell
+Wireshark to save to a specific (“permanent”) file and switch to a
+different file after a given time has elapsed or a given number of packets
+have been captured. These options are controlled in the
+“Capture Options” dialog's “Output” tab.
+
+[#ChCapCaptureOptionsOutputDialog]
+.Capture output options
+image::images/ws-capture-options-output.png[{screenshot-attrs}]
+
+[TIP]
+====
+Working with large files (several hundred MB) can be quite slow. If you plan to do
+a long-term capture or capturing from a high traffic network, think about using
+one of the “Multiple files” options. This will spread the captured packets over
+several smaller files which can be much more pleasant to work with.
+====
+
+Using the “Multiple files” option may cut context related information. Wireshark keeps
+context information of the loaded packet data, so it can report context related
+problems (like a stream error) and keeps information about context related
+protocols (e.g., where data is exchanged at the establishing phase and only
+referred to in later packets). As it keeps this information only for the loaded
+file, using one of the multiple file modes may cut these contexts. If the
+establishing phase is saved in one file and the things you would like to see is
+in another, you might not see some of the valuable context related information.
+
+Information about the folders used for capture files can be found in
+<<AppFiles>>.
+
+[#ChCapTabCaptureFiles]
+.Capture file mode selected by capture options
+[options="header",cols="2,2,2,3,5"]
+|===
+|File Name|“Create a new file...”|“Use a ring buffer...”|Mode|Resulting filename(s) used
+|-|-|-|Single temporary file|wiresharkXXXXXX.pcap[ng] (where XXXXXX is a unique 6 character alphanumeric sequence)
+|foo.cap|-|-|Single named file|foo.cap
+|foo.cap|x|-|Multiple files, continuous|foo_00001_20230714110102.cap, foo_00002_20230714110318.cap, ...
+|foo.cap|x|x|Multiple files, ring buffer|foo_00001_20230714110102.cap, foo_00002_20230714110318.cap, ...
+|===
+
+Single temporary file::
+A temporary file will be created and used (this is the default).
+After capturing is stopped this file can be saved later under a user specified name.
+
+Single named file::
+A single capture file will be used.
+Choose this mode if you want to place the new capture file in a specific folder.
+
+Multiple files, continuous::
+Like the “Single named file” mode, but a new file is created and used after reaching one of the multiple file switch conditions (one of the “Next file every...” values).
+
+Multiple files, ring buffer::
+Much like “Multiple files continuous”, reaching one of the multiple files switch
+conditions (one of the “Next file every ...” values) will switch to the next
+file. This will be a newly created file if value of “Ring buffer with n files”
+is not reached, otherwise it will replace the oldest of the formerly used files
+(thus forming a “ring”).
++
+This mode will limit the maximum disk usage, even for an unlimited amount of
+capture input data, only keeping the latest captured data.
+
+[#ChCapLinkLayerHeader]
+
+=== Link-layer header type
+
+In most cases you won’t have to modify link-layer header type. Some exceptions
+are as follows:
+
+If you are capturing on an Ethernet device you might be offered a choice of
+“Ethernet” or “DOCSIS”. If you are capturing traffic from a Cisco Cable
+Modem Termination System that is putting DOCSIS traffic onto the Ethernet to be
+captured, select “DOCSIS”, otherwise select “Ethernet”.
+
+If you are capturing on an 802.11 device on some versions of BSD you might be
+offered a choice of “Ethernet” or “802.11”. “Ethernet” will cause the
+captured packets to have fake (“cooked”) Ethernet headers. “802.11” will
+cause them to have full IEEE 802.11 headers. Unless the capture needs to be read
+by an application that doesn’t support 802.11 headers you should select
+“802.11”.
+
+If you are capturing on an Endace DAG card connected to a synchronous serial
+line you might be offered a choice of “PPP over serial” or “Cisco HDLC”. If
+the protocol on the serial line is PPP, select “PPP over serial” and if the
+protocol on the serial line is Cisco HDLC, select “Cisco HDLC”.
+
+If you are capturing on an Endace DAG card connected to an ATM network you might
+be offered a choice of “RFC 1483 IP-over-ATM” or “Sun raw ATM”. If the only
+traffic being captured is RFC 1483 LLC-encapsulated IP, or if the capture needs
+to be read by an application that doesn’t support SunATM headers, select “RFC
+1483 IP-over-ATM”, otherwise select “Sun raw ATM”.
+
+[#ChCapCaptureFilterSection]
+
+=== Filtering while capturing
+
+Wireshark supports limiting the packet capture to packets that match a
+_capture filter_. Wireshark capture filters are written in
+libpcap filter language. Below is a brief overview of the libpcap filter
+language's syntax. Complete documentation can be found at
+the link:{pcap-filter-man-page-url}[pcap-filter man page]. You can find
+many Capture Filter examples at {wireshark-wiki-url}CaptureFilters.
+
+You enter the capture filter into the “Filter” field of the Wireshark
+“Capture Options” dialog box, as shown in <<ChCapCaptureOptionsDialog>>.
+
+A capture filter takes the form of a series of primitive expressions connected
+by conjunctions (__and/or__) and optionally preceded by __not__:
+
+----
+[not] primitive [and|or [not] primitive ...]
+----
+
+An example is shown in <<ChCapExFilt1>>.
+
+[#ChCapExFilt1]
+.A capture filter for telnet that captures traffic to and from a particular host
+====
+----
+tcp port 23 and host 10.0.0.5
+----
+====
+
+This example captures telnet traffic to and from the host 10.0.0.5, and shows
+how to use two primitives and the __and__ conjunction. Another example is shown
+in <<ChCapExFilt2>>, and shows how to capture all telnet traffic except that
+from 10.0.0.5.
+
+[#ChCapExFilt2]
+.Capturing all telnet traffic not from 10.0.0.5
+====
+----
+tcp port 23 and not src host 10.0.0.5
+----
+====
+
+// XXX - add examples to the following list.
+
+A primitive is simply one of the following: _[src|dst] host <host>_::
+This primitive allows you to filter on a host IP address or name. You can
+optionally precede the primitive with the keyword _src|dst_ to specify that you
+are only interested in source or destination addresses. If these are not
+present, packets where the specified address appears as either the source or the
+destination address will be selected.
+
+ether [src|dst] host <ehost>::
+This primitive allows you to filter on Ethernet host addresses. You can
+optionally include the keyword _src|dst_ between the keywords _ether_ and _host_
+to specify that you are only interested in source or destination addresses. If
+these are not present, packets where the specified address appears in either the
+source or destination address will be selected.
+
+gateway host <host>::
+This primitive allows you to filter on packets that used _host_ as a gateway.
+That is, where the Ethernet source or destination was _host_ but neither the
+source nor destination IP address was _host_.
+
+[src|dst] net <net> [{mask <mask>}|{len <len>}]::
+This primitive allows you to filter on network numbers. You can optionally
+precede this primitive with the keyword _src|dst_ to specify that you are only
+interested in a source or destination network. If neither of these are present,
+packets will be selected that have the specified network in either the source or
+destination address. In addition, you can specify either the netmask or the CIDR
+prefix for the network if they are different from your own.
+
+
+[tcp|udp] [src|dst] port <port>::
+This primitive allows you to filter on TCP and UDP port numbers. You can
+optionally precede this primitive with the keywords _src|dst_ and _tcp|udp_
+which allow you to specify that you are only interested in source or destination
+ports and TCP or UDP packets respectively. The keywords _tcp|udp_ must appear
+before _src|dst_.
++
+If these are not specified, packets will be selected for both the TCP and UDP
+protocols and when the specified address appears in either the source or
+destination port field.
+
+less|greater <length>::
+This primitive allows you to filter on packets whose length was less than or
+equal to the specified length, or greater than or equal to the specified length,
+respectively.
+
+ip|ether proto <protocol>::
+This primitive allows you to filter on the specified protocol at either the
+Ethernet layer or the IP layer.
+
+ether|ip broadcast|multicast::
+This primitive allows you to filter on either Ethernet or IP broadcasts or
+multicasts.
+
+<expr> relop <expr>::
+This primitive allows you to create complex filter expressions that select bytes or ranges of bytes in packets.
+Please see the pcap-filter man page at {pcap-filter-man-page-url} for more details.
+
+
+[#ChCapCaptureAutoFilterSection]
+
+==== Automatic Remote Traffic Filtering
+
+If Wireshark is running remotely (using e.g., SSH, an exported X11 window, a
+terminal server, ...), the remote content has to be transported over the
+network, adding a lot of (usually unimportant) packets to the actually
+interesting traffic.
+
+To avoid this, Wireshark tries to figure out if it’s remotely connected (by
+looking at some specific environment variables) and automatically creates a
+capture filter that matches aspects of the connection.
+
+The following environment variables are analyzed:
+
+`SSH_CONNECTION` (ssh)::
+<remote IP> <remote port> <local IP> <local port>
+
+
+`SSH_CLIENT` (ssh)::
+<remote IP> <remote port> <local port>
+
+
+`REMOTEHOST` (tcsh, others?)::
+<remote name>
+
+`DISPLAY` (x11)::
+[remote name]:<display num>
+
+
+`SESSIONNAME` (terminal server)::
+<remote name>
+
+On Windows it asks the operating system if it’s running in a Remote Desktop Services environment.
+
+[#ChCapRunningSection]
+
+=== While a Capture is running ...
+
+You might see the following dialog box while a capture is running:
+
+[#ChCapCaptureInfoDialog]
+.The “Capture Information” dialog box
+image::images/ws-capture-info.png[{small-screenshot-attrs}]
+
+This dialog box shows a list of protocols and their activity over time.
+It can be enabled via the “capture.show_info” setting in the “Advanced”
+preferences.
+
+[#ChCapStopSection]
+
+==== Stop the running capture
+
+A running capture session will be stopped in one of the following ways:
+
+. The btn:[Stop Capture] button in the “Capture Information” dialog box.
+
+. The menu:Capture[Stop] menu item.
+
+. The btn:[Stop] toolbar button.
+
+. Pressing kbd:[Ctrl+E].
+
+. The capture will be automatically stopped if one of the _Stop Conditions_ is
+ met, e.g., the maximum amount of data was captured.
+
+[#ChCapRestartSection]
+
+==== Restart a running capture
+
+A running capture session can be restarted with the same capture options as the
+last time, this will remove all packets previously captured. This can be useful,
+if some uninteresting packets are captured and there’s no need to keep them.
+
+Restart is a convenience function and equivalent to a capture stop following by
+an immediate capture start. A restart can be triggered in one of the following
+ways:
+
+. Using the menu:Capture[Restart] menu item.
+
+. Using the btn:[Restart] toolbar button.
+
+// End of WSUG Chapter Capture