Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Display filter help need. how to do these filters? DNS /L2

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 20 Feb 2014 15:01:12 -0800
On Feb 20, 2014, at 2:10 PM, false <jctx09@xxxxxxxxx> wrote:

> Can someone provide an example please on how to do these filters (display and/or capture)?

	...

> 2) L2 Overhead - Can I get filter out all L2 overhead to see what the total amount of data sent was with and without L2 overhead. ??

That's a different type of "filter" from a capture or display filter.  Capture or display filters either match or don't match a packet, and filter out entire packets that don't match.  You want a way to filter out part of all packets; Wireshark doesn't have a convenient mechanism to do that.