4R.cz

Wireshark filters

125 ready-to-use display filters for the green filter bar in Wireshark, from the everyday ones to the few that solve most packet-loss and TLS problems. They only hide packets from the list, so you can change them at any time and nothing is lost. Click Copy and paste one straight into Wireshark.

Capture filters are a different thing: they use BPF syntax (the same as tcpdump), are set in Capture → Options before the capture starts, and whatever they reject is never recorded. They are at the bottom of this page — do not paste them into the display filter bar.

Field names change between Wireshark versions; these follow the current ones in 3.x and 4.x. If Wireshark refuses a filter, check the field name in the packet details pane — the status bar tells you exactly which part it did not understand.

Syntax basics

ip.src == 10.0.0.1
Field equals a value. Text values need quotes: http.host == "example.com".
!(ip.addr == 10.0.0.9)
Exclusion. Prefer this over ip.addr != 10.0.0.9, which also matches packets whose other address differs.
tcp && ip.addr == 10.0.0.5
AND - also written as "and".
http || dns
OR - also written as "or".
!arp
NOT - also written as "not".
http.host contains "example"
Substring search inside a field value.
http.request.uri matches "^/api/v[0-9]+/"
Regular expression (PCRE).
udp.port in {53, 123, 5353}
A set of ports in one expression: DNS, NTP and mDNS.
ipv6.addr == 2001:db8::/32
Address belongs to a subnet.
frame.len > 1400
Numeric comparison: ==, !=, >, <, >=, <=.
frame contains "password"
Byte search in the whole frame; narrow it with tcp contains "GET /".
http.user_agent
A bare field name matches every packet where the field exists.
eth.dst[0:3] == 00:1a:2b
Byte slice - here the first three bytes of the destination MAC.

Addresses

ip.addr == 10.0.0.5
Source or destination address.
ip.src == 10.0.0.5
Source only; ip.dst == 10.0.0.5 is the opposite direction.
ip.addr == 10.0.0.5 && ip.addr == 203.0.113.9
Traffic between exactly these two hosts.
ip.addr == 10.0.0.0/8
Everything in a subnet, in either direction.
!(ip.addr == 10.0.0.5)
Everything that does not involve the host.
ipv6.addr == 2001:db8::1
IPv6 equivalent of ip.addr; also ipv6.src and ipv6.dst.
eth.addr == 00:11:22:33:44:55
MAC address, either direction.
eth.dst == ff:ff:ff:ff:ff:ff
Broadcast frames.
eth.src[0:3] == 00:11:22
Vendor prefix (OUI) of the source MAC.
ip.ttl < 5
Suspiciously low TTL, typical of a routing loop.
ip.flags.df == 1
Do not Fragment set - path MTU probing.
ip.frag_offset > 0
Fragmented packets (the follow-up fragments).

Protocols

tcp
All TCP traffic.
udp
All UDP traffic.
arp
ARP requests and replies.
icmp
ICMP for IPv4; use icmpv6 for IPv6.
dns
DNS, queries and responses.
http
HTTP/1.x; for HTTP/2 use http2.
tls
TLS handshakes and encrypted records.
dhcp
DHCP and BOOTP traffic.
ntp
Time synchronisation.
ssh
SSH sessions.
ftp
FTP control channel; ftp-data carries the transfers.
smtp
Mail submission and relaying.
quic
QUIC, which carries HTTP/3 and more.
mdns
Multicast DNS, the usual source of local noise.
nbns
NetBIOS name service (Windows name resolution).
llmnr
Link-local multicast name resolution.
ssdp
SSDP/UPnP discovery.
smb2
SMB 2 and 3 file sharing.
snmp
SNMP polling and traps.
radius
RADIUS authentication.
stun
STUN/TURN, common with VoIP and WebRTC.
tls || quic
Overview of encrypted application traffic.
arp || icmpv6
Local discovery chatter only.
tcp.port == 80 || tcp.port == 8080
A protocol on a non-standard port, for when the dissector does not recognise it.

TCP and UDP

tcp.port == 443
Source or destination port.
udp.port == 53
UDP port, mostly DNS.
tcp.srcport == 54321
Source port only; tcp.dstport is the destination.
tcp.port in {80, 443, 8080}
Any of several ports without repeating the expression.
tcp.flags.syn == 1 && tcp.flags.ack == 0
Connection attempts (SYN without ACK).
tcp.flags.reset == 1
Resets - a refused connection or a firewall.
tcp.flags.fin == 1
Graceful connection teardown.
tcp.len == 0
Pure acknowledgements with no payload.
tcp.len > 0
Packets that actually carry data.
tcp.analysis.retransmission
Retransmitted segments - the first thing to check for loss.
tcp.analysis.fast_retransmission
Fast retransmit after duplicate ACKs.
tcp.analysis.duplicate_ack
Duplicate acknowledgements.
tcp.analysis.zero_window
Receiver advertised a zero window and the sender had to stop.
tcp.analysis.flags
Every packet with any TCP expert warning - the broadest loss check.
tcp.stream eq 4
A single TCP conversation, numbered as in the packet details.
tcp.window_size_value < 1000
Small receive window, a hint of a slow receiver.
tcp.time_delta > 0.5
More than half a second since the previous packet of the same stream. If it stays empty, enable Calculate conversation timestamps in the TCP protocol preferences.

HTTP

http.request
Requests only; http.response for responses.
http.request.method == "POST"
Requests by method: GET, POST, PUT, DELETE.
http.host == "example.com"
Requests to one virtual host.
http.request.uri contains "/login"
Path or query substring.
http.request.full_uri contains "api"
The complete URL, host included.
http.response.code == 404
One exact status code.
http.response.code >= 400
Client and server errors.
http.response.code == 301 || http.response.code == 302
Redirects.
http.content_type contains "json"
Responses by content type.
http.user_agent contains "curl"
Requests by user agent.
http.cookie contains "session"
Cookie header present and matching.
http.authorization
Requests carrying credentials - never publish such a capture.
http2.header.value contains "example.com"
HTTP/2 headers; http2.header.name matches the header name, for example :authority.

DNS

dns.flags.response == 0
Queries only; dns.flags.response == 1 are the answers.
dns.qry.name == "example.com"
One exact name.
dns.qry.name contains "google"
Name substring, handy for spotting beaconing.
dns.qry.type == 1
Record type: 1 = A, 28 = AAAA, 5 = CNAME, 15 = MX, 16 = TXT.
dns.qry.name == "example.com" && dns.qry.type == 28
One name and one record type together.
dns.flags.rcode != 0
Any error answer.
dns.flags.rcode == 3
NXDOMAIN - the name does not exist.
dns.count.answers == 0
Answers with no records, typical of filtering or blocking.
dns.time > 0.5
Responses slower than half a second, measured from query to answer.
dns.qry.name contains "example.com" && dns.flags.response == 1
Answers for a name, without the queries.
tcp.port == 53
DNS over TCP: zone transfers and large answers, including retries after a truncated reply.

TLS

tls.handshake
Handshake messages only, without the encrypted records.
tls.handshake.type == 1
Client Hello.
tls.handshake.type == 2
Server Hello.
tls.handshake.type == 11
Server certificate.
tls.handshake.extensions_server_name == "example.com"
SNI - the hostname the client asked for, visible without any keys.
tls.handshake.extensions_server_name contains "example"
SNI substring across many connections.
tls.handshake.extensions_alpn_str == "h2"
ALPN protocol offered by the client.
tls.handshake.extensions.supported_version == 0x0304
TLS 1.3 offered; 0x0303 is TLS 1.2.
tls.alert_message
Handshake and record alerts.
tls.alert_message.level == 2
Fatal alerts; level 1 is a warning.
tls.handshake.ja3
Client fingerprints (JA3/JA4), useful for spotting non-browser clients.
tls.app_data
Encrypted application data records.
tls && ip.addr == 10.0.0.5
TLS for one host - the usual first step in a certificate problem.
ssl.record.length
Fields are named tls. since Wireshark 3.0; older filters and captures may use the deprecated ssl. names.

DHCP, ARP and ICMP

dhcp.option.dhcp == 1
DHCP Discover: 2 = Offer, 3 = Request, 4 = Decline, 5 = ACK.
dhcp.option.dhcp == 3
Client requests, useful to find a device asking for a lease.
dhcp.hw.mac_addr == 00:11:22:33:44:55
DHCP for one client MAC.
dhcp.option.hostname contains "laptop"
Client hostname in the request.
dhcp.option.dhcp_server_id == 10.0.0.1
Replies from one DHCP server.
arp.opcode == 1
ARP requests; arp.opcode == 2 are replies.
arp.dst.proto_ipv4 == 10.0.0.5
Who is asking for this address.
arp.duplicate-address-detected
Wireshark saw the same address claimed by two MACs.
icmp.type == 8
Echo requests (ping); icmp.type == 0 are the replies.
icmp.type == 3
Destination unreachable.
icmp.type == 11
Time exceeded - a traceroute hop or a routing loop.
icmpv6.type == 135 || icmpv6.type == 136
IPv6 neighbour solicitation and advertisement.
icmpv6.type == 133 || icmpv6.type == 134
IPv6 router solicitation and advertisement.

Finding the needle

!(arp || mdns || nbns || llmnr || ssdp)
Hide the usual local broadcast chatter.
!(icmpv6.type == 135 || icmpv6.type == 136)
Hide IPv6 neighbour discovery on a busy network.
ip.addr == 10.0.0.5 && tcp.port == 443
One host and one service.
ip.addr == 10.0.0.5 && !(ip.addr == 10.0.0.9)
Traffic of a host except one peer.
tcp.flags.syn == 1 && tcp.flags.ack == 0 && tcp.analysis.retransmission
Connection attempts that had to be retried - a service or firewall not answering.
tcp.len > 0 && ip.addr == 10.0.0.5
Real data for one host, without the acknowledgements.
_ws.malformed
Packets Wireshark could not decode.
_ws.col.Info contains "Retransmission"
Anything labelled as a retransmission, whatever the protocol.

Capture filters (BPF)

These belong in Capture → Options → Capture filter, or on the tcpdump and dumpcap command line. What they drop is never written to the file, so when in doubt capture everything and filter afterwards with a display filter.

host 10.0.0.5
All traffic to or from a host.
src host 10.0.0.5
Source only; dst host is the opposite direction.
net 10.0.0.0/8
A whole subnet.
port 53
One port, TCP or UDP.
tcp port 443
TCP only, so DNS over UDP is not captured.
portrange 5060-5070
A range of ports.
host 10.0.0.5 and port 443
Conditions combined with and, or and not.
not arp
Drop ARP; what is dropped is not in the capture at all.
udp and not port 53
UDP without DNS.
vlan 100
One VLAN tag.
ether host 00:11:22:33:44:55
By MAC address.
tcp[tcpflags] & tcp-syn != 0
Packets with the SYN flag set.

Working faster