> Filter and File are not needed; they're optional.
In particular:
If no filter is specified, all packets seen will be captured.
If no file is specified, Ethereal will write to a temporary
file; when the capture is complete, the "File->Save As" menu
item can be used to save the capture to a named file.
"File" is there as a convenience to cause the capture to be saved to a
specific place while it's taking place, rather than after the fact, e.g.
if the default file system where the capture would be saved (typically
the one on which "/var/tmp" resides) doesn't have enough space for a
capture of the size you're likely to be making.
By default, though, leaving "File" blank is probably good enough, and
means that if the user doesn't want the capture saved to a permanent
file, Ethereal will get rid of the temporary file for them.
> > I would like to have a little examples of filters in order for me to
> > learn how to use this app !
>
> Which OS are you using.
In his case, probably some Linux distribution, as he said "I installed
the rpm".
> If Unix-like, the man page is a good thing to read,
> if Windows, read the ethereal.html file.
>
> However, for capture filters, the documentation will point you to the
> tcpdump man page, since tcpdump-style (actually, libpcap-style) filters
> are used for capture filters.
...and that man page does give examples of capture filters.
For Windows users, the WinDump man page (WinDump being a port of tcpdump
to Windows, using the same WinPcap port-of-libpcap-to-Windows library
that Ethereal uses) can be found at
http://netgroup-serv.polito.it/windump/docs/manual.htm
