Lucent Technologies Ethereal - Manual (Page 118)

As you might have noticed, only packets of the TCP protocol are displayed now (e.g. packets 1-10
are hidden). The packet numbering will remain as before, so the first packet shown is now packet
number 11.
Note!
When using a display filter, all packets remain in the capture file. The display filter
only changes the display of the capture file but not its content!
You can filter on any protocol that Ethereal understands. You can also filter on any field that a dis-
sector adds to the tree view, but only if the dissector has added an abbreviation for the field. A list of
such fields is available in the Ethereal in the Add Expression... dialog box. You can find more in-
formation on the Add Expression... dialog box in
Section 6.4, “The "Filter Expression" dialog
box” .
For example, to narrow the packet list pane down to only those packets to or from the IP address
192.168.0.1, use ip.addr==192.168.0.1.
Note!
To remove the filter, click on the Clear button to the right of the filter field.
Working with captured packets
104