See the Wireshark equivalent#
Open the preview under the filter bar to read the Wireshark display filter your expression compiles to.
The filter bar accepts an expression language built around field:value clauses. The workspace evaluates each filter against the capture with the underlying Wireshark display-filter syntax. The compiled DSL preview shows you the translation.
Show the preview#
When the filter bar has any input, an </> icon appears next to the clear button on the right. Select the icon to open a preview of the compiled Wireshark DSL underneath the bar. Select it again to hide the preview.
The preview updates as you edit the filter, so you can see how each pill, operator, and join translates.
Compare the two forms#
The preview is a single line of monospaced text. It shows the Wireshark equivalent of the current filter. For example:
| Filter bar | Compiled DSL |
|---|---|
protocol:TCP | tcp |
protocol:TCP AND dstPort:443 | tcp && tcp.dstport == 443 |
sourceAddress:192.168.178.62 | ip.src == 192.168.178.62 |
protocol:(TCP OR UDP) | tcp || udp |
-protocol:DNS | !(dns) |
When the preview helps#
- Learn the Wireshark syntax. The translation is the same DSL that Wireshark accepts in its display-filter bar, so anything the preview shows works there too.
- Share a filter with someone who uses a different tool. Copy the DSL line and paste it into a tool that accepts Wireshark filters.
- Debug a complex expression. If a filter does not match the frames you expected, the compiled form usually shows the problem.
The preview is read-only. To change the filter, edit the bar above. The preview follows.