tcpdump filter builder
Build a tcpdump BPF filter and its Wireshark equivalent from hosts, ports and protocols, plus the full capture command.
tcpdump filter builder
Assemble a tcpdump capture filter without memorizing BPF syntax. Fill in a source and destination address or subnet, a port or port range and a protocol, and the tool builds the matching filter expression, wraps it into a complete tcpdump command with your interface and switches, and prints the equivalent Wireshark display filter alongside it — useful when you capture on the command line but inspect the result in the GUI.
Addresses accept a plain host ("10.0.0.5"), a CIDR subnet ("10.0.0.0/24") or a hostname, validated separately for source and destination. The port field takes a single port or a range like "8000-9000"; "Apply port to" decides whether it matches either side of the connection or only the source or destination port. Protocol narrows the capture to TCP, UDP or ICMP — leave it on "Any" to match every transport, in which case the Wireshark filter ORs both TCP and UDP ports, since Wireshark has no protocol-agnostic port field the way BPF does. "Negate filter" wraps the whole expression in tcpdump's not (…), for capturing everything except a match.
Interface, packet count and the pcap output file become the -i, -c and -w switches on the assembled command, so what you see is exactly what you'd run. ICMP has no ports, so combining it with a port filter is flagged as an error rather than silently building a filter that matches nothing — the same goes for negating an empty filter, or an interface or file name with characters that would break the command.
Everything runs in your browser: the addresses, ports and file names you type are never sent anywhere, and the filter is assembled entirely by local JavaScript. Copy the command, download it as a .txt file, or send the output back into the input to keep adjusting it.