What does this Wireshark capture filter do

Question

I was reading through a guide where I saw the following Wireshark capture filter used.

(tcp[2:2] > 1500 and tcp[2:2] < 1550) 

I had a brief look over Wireshark's website which listed their documentation for the various commands, but I could not make any sense of it. Any tutorials I found covered other helpful, but not relevant, ways to capture filter, for example host www.example.com and not (port 80 or port 25) which at least made sense.

Could someone please explain what each part of this capture filter is doing?

Answer 1

The capture filter isn't really Wireshark syntax but that of the underlying capture library. Depending on that library, syntax may differ somewhat.

tcp[2:2] means from the TCP header, at two bytes offset, take two bytes/octets which is the destination port number.

Accordingly, (tcp[2:2] > 1500 and tcp[2:2] < 1550) means "capture TCP-carrying packets with destination ports from 1501 to 1549".

With newer capture libraries, tcp dst portrange 1501-1549 is the equivalent (and easier to memorize).