Glossary: Security Monitoring and Automation

capture filter

Also written: tshark -f

A filter applied while recording packets, such as `tcp port 80`: packets that don't match are never saved. tcpdump uses capture filters, and so does tshark with `-f`.