Getting ready

Structured filters are written in the following format:

[not] primitive [and|or [not] primitive ...] 

The following modifiers are commonly used in Wireshark capture filters:

• ! or not
• && or and
• || or or

For bitwise operators, use:

• & for AND operation
• | for OR operation