Wireshark Display Filters

The display filters you actually use — ip, tcp, http, dns, tls & follow stream

Wireshark Display Filters Cheat Sheet

Wireshark is a graphical packet analyzer; display filters narrow a capture down to the traffic you care about (they are different from capture/BPF filters). For authorized testing only.

1. Display filters vs. capture filters

	Display filter	Capture filter (BPF)
Where	Top filter bar (green when valid)	Capture → Options
Syntax	ip.addr == 10.0.0.1	host 10.0.0.1
When	After capture, re-applyable	Before capture, drops packets
Operators	== != > < >= <= && || !	and or not

This sheet covers display filters. Apply with Enter; clear with the X.

2. Comparison & logical operators

==   eq      equal
!=   ne      not equal
>    gt      greater than
<    lt      less than
>=   ge      <=  le
&&   and     ||  or      !  not

ip.addr == 10.0.0.5 && tcp.port == 443
http.response.code >= 400
!(arp || icmp)                 # hide ARP and ICMP noise

3. IP / addressing

ip.addr == 10.0.0.5            # src OR dst (use != with care)
ip.src == 10.0.0.5
ip.dst == 192.168.1.0/24       # CIDR supported
ip.addr == 10.0.0.5 && ip.addr == 10.0.0.9   # conversation between two hosts
ipv6.addr == ::1
eth.addr == 00:11:22:33:44:55  # MAC
ip.ttl < 64

Tip: ip.addr != x means "any field not equal" and rarely does what you want. Use !(ip.addr == x) to exclude a host.

4. Ports & transport (TCP / UDP)

tcp.port == 80                 # src OR dst port
tcp.srcport == 443
tcp.dstport == 22
udp.port == 53
tcp.flags.syn == 1 && tcp.flags.ack == 0   # SYN only (connection attempts)
tcp.flags.reset == 1           # RSTs
tcp.flags.fin == 1
tcp.analysis.retransmission    # retransmits
tcp.analysis.flags             # all expert TCP problems
tcp.len > 0                    # segments carrying data
tcp.stream == 3                # one specific TCP stream

Flag filter	Bit
tcp.flags.syn == 1	SYN
tcp.flags.ack == 1	ACK
tcp.flags.fin == 1	FIN
tcp.flags.reset == 1	RST
tcp.flags.push == 1	PSH

5. HTTP

http                           # all HTTP
http.request                   # requests only
http.response                  # responses only
http.request.method == "POST"
http.request.method == "GET"
http.request.uri contains "admin"
http.host == "example.com"
http.response.code == 200
http.response.code >= 400      # client/server errors
http.cookie
http.authorization             # Basic/Bearer auth headers
http.user_agent contains "curl"
http.content_type contains "json"

6. DNS

dns                            # all DNS
dns.flags.response == 0        # queries
dns.flags.response == 1        # responses
dns.qry.name == "example.com"
dns.qry.name contains "google"
dns.qry.type == 1              # A record (28 = AAAA, 15 = MX, 16 = TXT)
dns.flags.rcode != 0           # errors (NXDOMAIN etc.)
dns.a == 8.8.8.8               # answer holds this IP

7. TLS / SSL

tls                            # all TLS
tls.handshake                  # handshake messages
tls.handshake.type == 1        # ClientHello (2 = ServerHello)
tls.handshake.extensions_server_name == "example.com"   # SNI
tls.record.version == 0x0303   # TLS 1.2
tls.alert_message              # alerts

8. Other common protocols

arp                            icmp           icmpv6
dhcp                           # (bootp on older builds)
ftp                            ftp-data
smtp                           pop            imap
ssh
smb || smb2
kerberos
ntp
snmp
telnet

9. String matching & field tests

frame contains "password"      # raw byte/string search anywhere in frame
http contains "flag{"
tcp matches "(?i)login"        # regex (PCRE), case-insensitive
dns.qry.name matches "\\.ru$"
http.request.uri[0:4] == "/api"   # slice
field                          # filter "field exists" (e.g. http.cookie)
!field                         # field absent

10. Real-world filter recipes

# Plaintext creds in transit
http.authorization || ftp.request.command == "PASS" || telnet

# Possible port scan (lots of SYNs, no data)
tcp.flags.syn == 1 && tcp.flags.ack == 0

# Exfil / large POSTs
http.request.method == "POST" && http.content_length > 1000

# Failed logins to one host
ip.dst == 10.0.0.5 && http.response.code == 401

# Suspicious DNS to one domain only
dns.qry.name contains "evil.com"

# Everything in/out of a single host, no broadcast noise
ip.addr == 10.0.0.5 && !(arp || icmpv6 || dns)

11. Follow Stream & quick tips

• Right-click a packet → Follow → TCP / UDP / HTTP / TLS Stream to reassemble a full conversation; Wireshark auto-builds a tcp.stream eq N filter.
• In the Follow window switch Show data as → ASCII / Hex Dump / Raw; use Find to locate creds or flags.
• Right-click any field → Apply as Filter → Selected to build filters without typing.
• Statistics → Conversations / Endpoints to spot top talkers, then right-click → Apply as Filter.
• Save a verbose filter as a button (right of the filter bar, the +) for reuse.
• tshark -r capture.pcap -Y 'http.request' -T fields -e http.host -e http.request.uri runs the same display-filter syntax on the CLI.

Authorized testing only. Practice on the AYSEC challenges. Pair with tcpdump for headless capture and nmap for the scans you'll see in the trace.