Embodiments disclose a method and computer program products for automatically generating a list of search criteria to be used by the computing system when searching captured data frames for one or more resulting data frames having a specific protocol field. The method includes an act of accessing a specific protocol field from one of the captured data frames and an act of accessing protocol definitions. The captured data frame is then interpreted using the protocol definitions to generate a list of additional protocol field and value pairs to use for searching the captured data frames. Finally, the specific protocol field and the list of additional protocol field and value pairs are used to automatically identify the one or more resulting data frames having the specific protocol field.