The first stage filtering I have been talking about is configured in the Capture options window using so-called tcpdump filter expressions, however, they are more limited and their syntax can be slightly more difficult so for a starting user of the Wireshark, the filtering of displayed packets is much easier (and pretty much what anybody uses anyway). Open Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap in Wireshark.

This will make sure that only the packets that carry the BGP messages will be displayed. Viewing the pcap in Wireshark using the basic web filter without any decryption.

frame.len 0x20 contains Protocol, field or slice contains a value. frame.len ge 0x100 le < Less than or equal to.

frame.len < 128 ge > Greater than or equal to.

If, on the other hand, you want to see only the BGP communication then you may want to write Wireshark Filters Relations English C-like Description and example eq Equal. In the Filter line (yes, together with the exclamation mark that means 'not'). Specifically, if you do not want to see the STP packets but want to see everything else, write Much easier is using the second stage - i.e., after you capture all traffic and possibly stop the capture, you write your filter expression in the 'Filter' line in the upper part of the Wireshark window and click on 'Apply'. which packets that have been captured will be displayed to you).

which packets will be captured), the second stage is when the captured packets are displayed (i.e. The first stage is when the packets are captured (i.e. You can do filtering in two stages in Wireshark.

Wireshark filters