You can still use the old filter names for the time being, e.g., “bootp.type” is equivalent to “dhcp.type” but Wireshark will show the warning “'bootp' is deprecated” when you use it. For example, the DHCP dissector was originally developed for the BOOTP protocol but as of Wireshark 3.0 all of the “bootp” display filter fields have been renamed to their “dhcp” equivalents.

In such cases they will add an alias from the old protocol name to the new one in order to make the transition easier. If a protocol dissector originally used the older names and fields for a protocol the Wireshark development team might update it to use the newer names and fields.

For example, DHCP extends and has largely replaced BOOTP and TLS has replaced SSL. Sometimes Fields Change Names As protocols evolve they sometimes change names or are superseded by newer standards. Why does the filter expression “bootp” give you a warning in Wireshark 3.x and higher? How many unique non-broadcast MAC addresses can be found in the trace? Interface #0 info: Encapsulation = Ethernet ( 1 - ether ) File timestamp precision: microseconds (6 )

Wireshark examples