Apologies ahead of time if I missed an article or a posting with the answer to this question...
I'm fairly new to Wireshark and I was analyzing my network traffic, I'd like to be able to do multiple display filters without having it all clumped in the overhead one line filter field.
Currently its set to a long string of '!(ipv6.src == xxxx::xxxx:x... or ip.dst == xxx.xxx... or arp or lldp or ...)'. I'd like to know if there a way of creating kind of a separate file with a nicely formatted list of all the 'noise' I want tucked away so that I only see sneaky traffic. That or if there is a better method of filter large quantities of known connections so that I only see what I want to see.
Thank you much!
EDIT:
Thanks to Jaap Keuter for the pointer on Wireshark Display Filter Macros. There seems to be some thin documentation online from what I could find after some short searches, this is what I've found:
This has a pretty good write up on Display Filter Macros https://support.cloudshark.org/administrator-guide/display-filter-macros.html
In Wireshark go to 'Analyze' > 'Display Filter Macros...'
For 'Name' type a name for your macro which you will later use to call it. For 'Text' type in your query e.g. '!(ip.src == 192.168.2.1 or arp or lldp)' or if you prefer something like '!(ip.src == $1 or ip.src == $2)' where $# is an item you will fill later when calling the macro.
Example used later on:
Name: 'Nonlocal' Text: '!(ip.src >= $1 && ip.src <= $2)'
Calling the Macro:
In Wireshark, where the 'Apply a display filter... ' appears type in ${YourMacroName} if it has no variables to pass on.
If there are variables to pass on in the case of '!(ip.src == $1 or ip.src == $2)' then type the following when calling your macro '${YourMacroName:Value1;Value2}'
Example from before in action: ${NonLocal:192.168.2.0;192.168.2.255}
EDIT#2
Combining several Display Filter Macros is fairly simple, after a quick test I found that using && allows you to run multiple Macros at once. e.g: '${Macro1} && ${Macro2}'
Hope that helps someone.