Wireshark - Filters

Wireshark Filter Reference

wireshark cheatsheet filters

---

Filter Types

Type	When Applied	Use Case
Capture Filter	During capture	Reduce file size, capture only relevant traffic
Display Filter	After capture	Analyze subset of captured packets

Note: Capture filters use BPF syntax (tcpdump-style). Display filters use Wireshark’s own syntax.

---

Display Filter Syntax

Operators

Operator	Meaning	Example
== or eq	Equals	ip.addr == 10.1.1.1
!= or ne	Not equals	tcp.port != 22
> or gt	Greater than	frame.len > 1000
< or lt	Less than	tcp.window_size < 1000
>= or ge	Greater or equal	ip.ttl >= 64
<= or le	Less or equal	tcp.analysis.rtt <= 0.1
contains	Contains string	http.host contains "api"
matches or ~	Regex match	http.request.uri matches ".*\\.jpg"

Logical Operators

Operator	Meaning	Example
and or &&	Both true	ip.src == 10.1.1.1 and tcp.port == 443
or or ||	Either true	tcp.port == 80 or tcp.port == 443
not or !	Negate	not arp
()	Grouping	(tcp.port == 80 or tcp.port == 443) and ip.src == 10.1.1.1

IP Filters

Filter	Description
ip.addr == 10.1.1.1	Source OR destination
ip.src == 10.1.1.1	Source only
ip.dst == 10.1.1.1	Destination only
ip.addr == 10.1.1.0/24	Subnet (CIDR)
ip.src == 10.1.1.0/24 and ip.dst == 10.2.2.0/24	Between subnets

TCP/UDP Filters

Filter	Description
tcp	All TCP traffic
udp	All UDP traffic
tcp.port == 443	Source OR destination port
tcp.srcport == 443	Source port
tcp.dstport == 443	Destination port
tcp.port in {80 443 8080}	Multiple ports
tcp.flags.syn == 1	SYN packets
tcp.flags.syn == 1 and tcp.flags.ack == 0	SYN only (new connections)
tcp.flags.rst == 1	RST packets
tcp.flags.fin == 1	FIN packets

HTTP Filters

Filter	Description
http	All HTTP traffic
http.request	HTTP requests only
http.response	HTTP responses only
http.request.method == "GET"	GET requests
http.request.method == "POST"	POST requests
http.host == "example.com"	Specific host
http.host contains "api"	Host contains string
http.request.uri contains "/login"	URI path
http.response.code == 200	Status code
http.response.code >= 400	Error responses

TLS/SSL Filters

Filter	Description
tls	All TLS traffic
tls.handshake	Handshake messages
tls.handshake.type == 1	Client Hello
tls.handshake.type == 2	Server Hello
tls.handshake.extensions_server_name	SNI field present
tls.handshake.extensions_server_name == "example.com"	Specific SNI
tls.alert_message	TLS alerts
ssl.handshake.ciphersuite	Cipher suite negotiation

DNS Filters

Filter	Description
dns	All DNS
dns.qry.name == "example.com"	Query for domain
dns.qry.name contains "example"	Query contains
dns.qry.type == 1	A record queries
dns.qry.type == 28	AAAA record queries
dns.flags.response == 1	DNS responses
dns.flags.rcode != 0	DNS errors

Troubleshooting Filters

Connection Issues

Filter	What It Finds
tcp.analysis.retransmission	Retransmitted packets
tcp.analysis.fast_retransmission	Fast retransmissions
tcp.analysis.duplicate_ack	Duplicate ACKs
tcp.analysis.zero_window	Zero window (receiver buffer full)
tcp.analysis.window_full	Sender limited by receiver window
tcp.analysis.lost_segment	Lost segment detected
tcp.flags.rst == 1	Connection resets

Performance Issues

Filter	What It Finds
tcp.analysis.ack_rtt > 0.2	High RTT (>200ms)
frame.time_delta > 1	Gaps > 1 second
tcp.window_size < 1000	Small TCP window

Combined Troubleshooting

tcp.analysis.retransmission or tcp.analysis.duplicate_ack or tcp.analysis.zero_window

Capture Filters (BPF Syntax)

Filter	Description
host 10.1.1.1	To or from IP
src host 10.1.1.1	From IP
dst host 10.1.1.1	To IP
net 10.1.1.0/24	Subnet
port 443	Port (TCP or UDP)
tcp port 443	TCP port only
portrange 8000-8100	Port range
not port 22	Exclude port
host 10.1.1.1 and port 443	Combined

Workflow Examples

Investigate Slow Application

# Find retransmissions between client and server
ip.addr == [client] and ip.addr == [server] and tcp.analysis.retransmission

# Check for high latency
ip.addr == [client] and ip.addr == [server] and tcp.analysis.ack_rtt > 0.1

Troubleshoot TLS Handshake Failures

# See handshake messages
ip.addr == [server] and tls.handshake

# Check for alerts
ip.addr == [server] and tls.alert_message

Find Why Connections Reset

# RST packets with context
tcp.flags.rst == 1 and ip.addr == [target]

# Follow TCP stream of a reset connection to see what happened