Filter Expression Buttons

Filter Expression Buttons are buttons you can create that are based on display filters; these can be used to quickly apply previously-saved display filters to your capture data to identify network and application problems.

For example, to create a Filter Expression Button option that displays just TCP SYN, SYN/ACK, FIN, or RST packets to analyze the TCP session setup parameters, network round-trip delay times, and session terminations:

1. Type the following display filter string into the Filter textbox on the Display Filter Bar:

   (tcp.flags&02 && tcp.seq==0) ||  (tcp.flags&12 && tcp.seq==0) || (tcp.flags.ack && tcp.seq==1 && !tcp.nxtseq > 0 && !tcp.ack >1)  || tcp.flags.fin == 1 || tcp.flags.reset ==1

2. Clicking on Apply will apply this filter to a capture that you have loaded so that you can confirm that it is working properly.

3. Then, click on Save and give the button a name, such as TCP Handshake (as illustrated in the...