Best Wireshark Filters

wireshark, formerly Ethereal, is a powerful open source program that helps users monitor and analyze information traveling to and from a specific network. The software can process complex data from hundreds of protocols on most types of networks, organizing them into data packets. However, when the network fails unexpectedly or has problems, searching through packets can become overwhelming and require a lot of time and energy. That’s where Wireshark’s ease of use comes in handy.

The software supports filters that allow you to quickly sift through large amounts of information. Instead of inspecting the captured files manually, you can apply a filter that will take you to the data you want to verify.

Read on to learn the best Wireshark filters and how to bookmark them for later use.

Wireshark Filters

There are two types of filters in Wireshark. The first is the capture filters, while the other is the display filters. They both operate with different syntax and have specific purposes.

Capture filters are set before starting a capture operation. Capture filter parameters only record and store the traffic you are interested in analyzing. Once the capture operation has started, modifying this type of filter is impossible.

On the other hand, display filters contain parameters that are applied to all captured packets. You can set this type of filter before starting a capture operation and then adjust or cancel it. Additionally, you will be able to set it while the operation is in progress. A display filter keeps data within a trace buffer, hiding traffic you’re not interested in and displaying only the information you want to see.

Wireshark has an impressive library of built-in filters to help users better monitor their networks. To access and use an existing filter, you must type the correct name in the “Apply a display filter” section below the program’s toolbar. When you want to search and apply a capture filter, use the “Enter a capture” section in the middle of the welcome screen.

Although Wireshark has comprehensive filtering capabilities, remembering the correct syntax is often difficult. When you struggle to write the right filter, you waste valuable time.

But you’re in luck. We’ve compiled a list of the best Wireshark filters to help you use the program more efficiently and take the guesswork out of analyzing reams of saved data.

Best Wireshark Filters

Let’s look at several useful filters that will allow you to master the program.

address.ip == xxxx

The filter above will only show captured packets that include the configured IP address. It is a useful tool for inspecting a type of traffic. The filter application will process the outgoing traffic and determine which one aligns with the source or IP you are looking for.

If you want to filter by destination, use the variant ip.dst == xxxx.

The ip.src == xxxx variant helps you filter by source.

address.ip == xxxx && address.ip == xxxx

This string establishes a conversation filter between two pre-established IP addresses. It is invaluable for verifying data between two networks or selected hosts. The filter ignores unnecessary data and only focuses on finding the information that interests you most.

For destination filtering, use the string ip.src == xxxx && ip.dst == xxxx.

http or dns

When you apply this filter it will show all dns or http protocols. It is a time-saving filter that allows you to focus on a specific protocol you want to examine. For example, if you need to find suspicious FTP traffic, all you need to do is set the filter to “ftp”. To find out why a web page is not appearing, set the filter to “dns”.

tcp.port==xxx

The filter above limits your search to a specific destination port or source. Instead of reviewing an entire captured packet, the filter generates data about traffic entering or leaving a single port. It is one of the most convenient filters that you can rely on to complete your task if you are short on time.

tcp.flags.reset==1

Applying this filter will show every TCP restart. Each captured packet has a TCP associated with it. When its value is set to one, it alerts the receiving PC to stop operating on that connection. This is one of the most impressive Wireshark filters, as a TCP reset ends the connection instantly.

tcp contains xxx

This filter will find all TCP capture packets that include the specified term. If you’re curious about where the item appears within a snapshot, type its name instead of “xxx.” The filter will locate all instances of the term, preventing you from having to read the packet. For example, when you replace “xxx” with “traffic”, you will see all packets that contain “traffic”. It is best to use this filter to scan a specific string or user ID.

!(arp or icmp or dns)

The filter above is designed to exclude specific protocols. Use it to remove the arp, dns or icmp protocol you don’t need. It allows you to block distracting data so you can focus on analyzing more urgent information.

tcp.time_delta > .250

This filter shows TCP packets with a delta time greater than 250 ms within their flow.

Remember that before using the filter, you must calculate the TCP conversion timestamp. While calculating conversation delays isn’t too difficult, it requires some advanced Wireshark knowledge.

tcp.analysis.flags &&!tcp.analysis.window_update

This filter helps you see retransmissions, zero windows, and duplicate attacks in a single trace. It’s a great way to find mediocre application performance or packet losses.

Tips for using Wireshark filters

Not remembering the correct syntax for a filter is frustrating and can prevent you from finding valuable data quickly.

Sometimes Wireshark’s autocomplete feature can help you solve the problem. For example, if you are sure that the filter begins with “tcp”, type this information in the appropriate search field. Wireshark will generate a list of filters starting with “tcp”. Scroll down the search results until you find the correct nickname.

Another way to search for filters is the “bookmark” option next to the input field. When you select “Manage display filters” or “Manage filter expressions,” you can modify, add, or delete filters. If you’re not particularly confident remembering complex syntax abbreviations, the “bookmark” option is a simple tool to retrieve frequently used Wireshark filters.

Instead of rewriting complex capture filters, follow the steps below to save them to the “bookmark” menu:

1. Launch wireshark and navigate to the “bookmark” option.
   
2. Click “Manage display filters” to display the dialog box.
   
3. Find the appropriate filter in the dialog box, tap it and press the “+” button to save it.
   

Here’s what you do to save a display filter:

1. Open Wireshark and go to the “bookmark” option.
   
2. Choose “Manage display filters” to open the dialog window.
   
3. Scan the list of options, double-tap the appropriate filter, and click the “+” button to save it as a bookmark.
   

If you’re in a hurry to analyze specific data, you may want to press the down arrow next to the input field. The action will generate a list of previously used filters.

Use filters for hassle-free data analysis

Wireshark has become one of the most popular network protocol analyzers thanks to its handy filters. You can use them to save time and quickly locate specific parameters such as IP addresses or HEX values. If you have trouble remembering the different nicknames of the filters you use frequently, save them as bookmarks for later use.