Using Display Filters
We can write a display filter at the 'Filter' box.
Each field in each protocol has a name (e.g. 'ip.src' for IP address of the host sending the packet).
Thus, we can use it in a display filter, e.g.
ip.src == mail.actcom.co.il or ip.dst == mail.actcom.co.il
Tip: when clicking on a field in a packet, its 'Ethereal' name will be shown in the status line.
Originally written by