a BPF filter
/ B-P-F /
When you tap into a busy network, packets fly past by the millions, and you almost never want all of them — you want the handful that matter to your problem. A BPF filter is the precise instruction you give the system that says "keep only packets like this; throw the rest away." It is like telling a mailroom "only forward me letters from this sender, marked urgent" instead of dumping every envelope on your desk. BPF stands for Berkeley Packet Filter, after the university where it was designed.
The beautiful part is where the filtering happens. A BPF filter is compiled into a tiny program that runs inside the operating-system kernel, right where packets arrive, before they are ever copied up to your tool. So when you write "tcp port 443 and host 10.0.0.5", the kernel checks each packet against that test and only hands up the ones that pass. This is far cheaper than copying every packet to user space and discarding most of them, and it is what lets tcpdump and Wireshark sift a 10 Gbps link without drowning. Filters combine fields and conditions with words like host, port, tcp, udp, and, or, and not — for example "udp port 53" captures DNS, and "icmp" captures ping and traceroute replies.
Two clarifications worth keeping straight. First, a capture-time BPF filter (which decides what the kernel keeps) is not the same as a display filter (which decides what a tool shows you from an already-captured set); Wireshark, confusingly, uses BPF syntax for the former and its own syntax for the latter. Second, the name BPF now also refers to a much broader in-kernel technology, eBPF, used for tracing, security, and networking far beyond packet capture; classic BPF for filters is its small, original ancestor.
Instead of capturing everything, you run "tcpdump 'tcp port 443 and host 10.0.0.5'". The kernel evaluates that BPF expression on each arriving packet and passes up only HTTPS traffic to or from 10.0.0.5 — so a few relevant packets reach your screen instead of a flood.
A BPF filter is a tiny test run inside the kernel before packets are copied up — keeping only what matches so high-speed capture stays affordable.
A capture filter (BPF, decides what the kernel keeps) is not a display filter (decides what a tool shows from data already captured). Wireshark uses BPF syntax for the first and its own syntax for the second — a classic point of confusion.