With wireshark how can I filter by packet size?

Question

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?

Solution 1

As you said in your comment:

greater <length>
less <length>

They also happen to be in this handy tcpdump cheat sheet I have on my wall.

Solution 2

Wireshark uses the same capture filter syntax as tcpdump, and it doesn't look like that's an option

Comments

[Denys]

Kyle's answer is correct. If you ever do need to use the display filter again, frame.len would be a better choice. "frame" is guaranteed to match every packet. The "data" dissector is usually only called as a last resort, and may not match very many packets.

[paxos1977]

cool, thanks for the info. I'll use frame.len from now on.

[paxos1977]

+1 for the link to the documentation... but you missed the "greater" option. Apparently, there is also a "len" option.

[mfinni]

Wow, yup. You're entirely correct- I was reading it looking for "size" and totally missed "len." Lame :-)