Wireshark-users: Re: [Wireshark-users] Display filter help need. how to do these filters? DNS /L2
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 20 Feb 2014 15:01:12 -0800
On Feb 20, 2014, at 2:10 PM, false <jctx09@xxxxxxxxx> wrote:

> Can someone provide an example please on how to do these filters (display and/or capture)?

	...

> 2) L2 Overhead - Can I get filter out all L2 overhead to see what the total amount of data sent was with and without L2 overhead. ??

That's a different type of "filter" from a capture or display filter.  Capture or display filters either match or don't match a packet, and filter out entire packets that don't match.  You want a way to filter out part of all packets; Wireshark doesn't have a convenient mechanism to do that.