Wireshark allows you to use display filters and capture filters to navigate your packets. These filters are easy to confuse. However, they serve different purposes and require different syntaxes to use. A display filter is used when you’ve captured everything you need and want to display specific packets for analysis. Capture filters are more limited than display filters. They reduce the size of a raw packet capture and must be set before you begin the packet capture process. You’ll typically use capture filters if you want to apply a command to return or remove specific types of packets from a capture. Capture filters can’t be modified during the capture process. Display filters and capture filters also differ in terms of the syntax they use. With a display filter, you use a combination of Boolean filters and operators to create a logical description of the filter you wish to create. Examples include the “==” and “!=” which mean equal and not equal, respectively. Capture filters use a more complicated syntax that combines masks, byte offsets, and hexadecimal values with Boolean filtering language. This makes capture filters less intuitive than display filters, though it also means you can use them to apply more complex filters.