In this chapter, we've learned about BPF syntax and its history and how to create BPF syntax. We also saw how to use that BPF and then apply it as a capture filter and reduce the packets that we end up capturing on our capturing interface. We then saw how to create and use display filters to prune what we have in a packet capture to what we just need to see. Furthermore, we saw how to follow streams, both TCP and UDP streams, so that we can view specific conversations within a packet capture and export that data if required. We also saw how to go into the different packet fields and lengths and all the different pieces of data within the headers of the packets and be able to create filters based on them.

In Chapter 4, Customizing Wireshark, we'll start tweaking Wireshark and actually customizing it and creating our own preferences and profiles so that we can make Wireshark our own.