Wireshark · Wireshark-users: Re: [Wireshark-users] Capturing Giant Packets Only

[Guy Harris <guy@xxxxxxxxxxxx>]

Sheahan, John wrote:
> I just discovered that some of my trunks are clocking lots of giant 
> packets and I wanted to know if there is a way to filter just for giants?

If giant packets are Ethernet frames > 1514 bytes (if you don't count 
the FCS)/1518 bytes (if you count the FCS), a capture filter such as 
"greater 1515" (confusingly, the "greater" operation in the 
libpcap/WinPcap filter parser is defined to mean "greater than or equal 
to") or "greater 1519", depending on whether your adapter supplies the 
FCS when capturing, should work.