Display filters - Display filters

Wireshark's display filters are a handy tool that allows you to filter and search for specific packets or information from network traffic. You can enter keywords directly into the search field. The search field accepts various search conditions and syntax.

• You can search for specific protocols by typing the name of the protocol. For example, by typing "http" in the search field, you will only see HTTP packets.
• You can filter by a specific IP address or port using IP addresses or port numbers in the search field. For example, by typing "ip.addr == 192.168.0.1", you will only see packets where the source or destination IP address is 192.168.0.1.
• You can use logical operators such as "and" and "or" to combine different search conditions. For example, "ip.addr == 192.168.0.1 and tcp.port == 80" will display only HTTP packets related to the IP address 192.168.0.1 and using TCP port 80.

Search field operators

• eq or == -> equals
• ne tai !=->Not equal to
• === -> Equals if more than one
• !== -> Not equal to if more than one
• gt or > -> Greater than
• lt or < -> Less than
• ge tai >= -> Greater than or equal to
• le tai <= -> Less than or equal to
• and or && -> And
• or or || -> Or

Examples

Show only traffic to port 25 (SMTP) and ICMP traffic.

tcp.port == 25 or icmp

Display only the traffic in this network. No Internet traffic.

ip.src == 192.168.1.0/24 and ip.dst == 192.168.1.0/24

Show SMB, HTTP and DNS traffic.

smb || http || dns

Show HTTP requests containing the string "lol"

http.request.uri matches "lol"

Show DNS traffic and do not show unwanted IP addresses

ip.src != XXX.XXX.XXX.XXX && ip.dst != XXX.XXX.XXX.XXX && dns

The best way to learn how to use search functionality is to freely experiment and wonder how different levers work and how to isolate packets.