Wireshark-users: Re: [Wireshark-users] Launching a new window from Display filters
FS <bastiji@...> writes:
> Thank you for the replies. Both excellent suggestions. Here's another one for
you gurus then. Lets say I start with a 1 Gig capture file. I see a lot of
extraneous chit-chat which I want to completely eradicate and then look at the
rest of the streams left. I was thinking more of an option of choose a display
filter, and then an option to sort of "discard" the results of the filter and
focus on the rest of the capture/conversations.An example could be using a
display filter to filter out the broadcast/arp/multicast traffic, and then
analyze the leftover data. Again, this can be accomplished by saving the
resulting 'noise-free' capture, and then re-opening it to further dissect it,
but is there another way to do this?Many thanks for the responses so
far!Regards,Basti
You can apply a display filter, for example, "arp", then choose, "Edit -> Ignore
All Displayed Packets (toggle)". This doesn't discard them, per se, but those
packets will no longer match any future display filters you might apply, as
Wireshark will now ignore them as if they were no longer present.
Ref: http://www.wireshark.org/docs/wsug_html_chunked/ChWorkIgnorePacketSection.html
