Skip to content

Cheatsheet

Wireshark display filters

Filter expressions to type from memory, grouped by what you are usually asking.

25 entries4 groupsRevised 16 Jan 2026Full Wireshark documentation

Addressing

  • One host either directionip.addr == 192.0.2.10
  • As source onlyip.src == 192.0.2.10
  • Subnetip.addr == 192.0.2.0/24
  • Either endpoint in a listip.addr in {192.0.2.10 192.0.2.11 192.0.2.12}
  • MAC addresseth.addr == aa:bb:cc:00:11:22
  • Not this address!ip.addr == 192.0.2.1

Ports & protocols

  • Port on either sidetcp.port == 443
  • Port rangetcp.port in {80 443 8000-8100}
  • UDP onlyudp && port 53
  • DNS queries onlydns.flags.response == 0
  • NXDOMAIN answersdns.flags.rcode == 3
  • TLS handshake failurestls.alert_message
  • HTTP requestshttp.request
  • HTTP status 500+http.response.code >= 500

TCP behaviour

  • SYNs (connection attempts)tcp.flags.syn == 1 && tcp.flags.ack == 0
  • RSTstcp.flags.reset == 1
  • Retransmissionstcp.analysis.retransmission
  • Zero window / back-pressuretcp.analysis.zero_window
  • Handshake duration fieldtcp.handshake.time > 0.25
  • One conversationtcp.stream eq 42

Content and size

  • Contains a stringframe contains "401 "
  • Matches a regex (case-insensitive)http.host matches "(?i)api\."
  • Bigger than a thresholdframe.len > 1400
  • Only the first 30 secondsframe.time_relative < 30
  • A header value existshttp.authorization