Using Display Filters

• We can write a display filter at the 'Filter' box.
• Each field in each protocol has a name (e.g. 'ip.src' for IP address of the host sending the packet).
• Thus, we can use it in a display filter, e.g.

  ip.src == mail.actcom.co.il or ip.dst == mail.actcom.co.il

• Tip: when clicking on a field in a packet, its 'Ethereal' name will be shown in the status line.

Originally written by guy keren