Once you create an expression and it is visible in the display filter, you can effortlessly create a button. In the right-hand corner, right after the Expression... link, hit the plus sign, and Wireshark will display a drop-down dialog box, as shown in the following screenshot:
Once the dialog box is open, you can enter an appropriate label and add a comment for the filter button. Wireshark will automatically enter the display filter for the button to run when clicked. When done, select OK and the new button will appear on the toolbar.
After working with Wireshark and adding buttons, you may want to remove some to clean up the toolbar. The following list shows the steps to edit filter buttons:
- Go to Edit and then Preferences, where you will see Filter Buttons, as shown in the following screenshot:
When selected, you will see whatever buttons are currently on your toolbar.
- To add a filter button, select the plus sign in the lower left-hand corner. Add what you would like as a Button Label. This (Button Label) is not case sensitive.
- Next, add Filter Expression, which must adhere to the expression and display filter rules.
If you want to remove any filter buttons, highlight the button you want to remove and select the minus sign in the lower left-hand corner.