How it works...

For host filtering, when you type a hostname, Wireshark will translate the name to an IP address and capture packets that refer to this address. For example, if you configure a filter host www.cnn.com, it will be translated by a name resolution service (usually DNS) to an IP address, and will show you all packets going to and from this address. Note that in this case, if the CNN website forwards you to other websites at other addresses, only packets to the first address will be captured.

When writing icmp[icmptype], it checks the ICMP type field in the ICMP header. icmp-echo has the code 8, and therefore you can write icmp[icmptype]==icmp-echo or icmp[icmptype]==8.