For example, to display only those packets that contain TCP source or destination port 80, use the tcp.port filter. You can also filter the captured traffic based on network ports. To exclude packets with a specific IP address, use the != operator. Observe that the packets with source or destination IP address as 50.116.24.50 are displayed in the output. To display both source and destination packets with a particular IP, use the ip.addr filter. Similarly, use ip.dst to filter results based on destination IP address. To filter results based on source IP, use the ip.src filter. Here is an example: http || arp || icmpĢ. If information related to more than one protocol is required, enter the protocol names separated by a double pipe (or a logical OR operator) ||. Observe that the Protocol column contains only HTTP entries. For example, the following screen shot displays information related to the HTTP protocol: To filter results based on a specific protocol, just write its name in the filter box and hit enter. To filter this information as per your requirement, you need to make use of the Filter box present at the top of the window. Note that a major part of the GUI is used to display information (like Time, Source, Destination, and more) about all the incoming and outgoing packets. Here is an example of a live capture in Wireshark: Udp.port = 5060 || tcp.Note – If you are completely new to Wireshark, it is recommended that you first go through its basic tutorial.

You can use the following operators to check conditions: Operator In this article, we’ll only focus on display filters that can help you find specific traffic quickly.įilters are set at the top of the Wireshark window in the Apply a display filter field.Ī Wireshark filter is a string where you can specify various filtering conditions. There are two types of Wireshark filters: display filters and capture filters. In this article, we have collected basic examples of Wireshark filters (by IP address, protocol, port, MAC address, etc.), which will be useful for a quick start.

For novice administrators, applying filters in Wireshark raises a number of questions. For the convenience of filtering all traffic passing through the network card, you can use Wireshark filters. Wireshark is a popular network traffic analysis tool that can be used to diagnose network connections and detect the activity of various programs and protocols. Popular Wireshark Filters (by IP, protocol, MAC, etc.)

Wireshark filter source