Wireshark provides a simple but powerful display filter language that allows you to build quite complex filter expressions. You can compare values in packets as well as combine expressions into more specific expressions. The following sections provide more information on doing this.
You will find a lot of Display Filter examples at the Wireshark Wiki Display Filter page at wireshark-wiki-display-filter:[wireshark-wiki-display-filter:].
Every field in the packet details pane can be used as a filter string, this will result in showing only the packets where this field exists. For example: the filter string: tcp will show all packets containing the tcp protocol.
There is a complete list of all filter fields available through the menu item→ in the page “Display Filter Fields” of the “Supported Protocols” dialog.
You can build display filters that compare values using a number of different comparison operators. They are shown in Table 6.4, “Display Filter comparison operators”.
You can use English and C-like terms in the same way, they can even be mixed in a filter string.
Table 6.4. Display Filter comparison operators
|English||C-like||Description and example|
Greater than or equal to.
Less than or equal to.
In addition, all protocol fields have a type. Table 6.5, “Display Filter Field Types” provides a list of the types and example of how to express them.
Table 6.5. Display Filter Field Types
Unsigned integer (8-bit, 16-bit, 24-bit, 32-bit)
You can express integers in decimal, octal, or hexadecimal. The following display filters are equivalent: ---- ip.len le 1500 ip.len le 02734 ip.len le 0x436 ----
Signed integer (8-bit, 16-bit, 24-bit, 32-bit)
A boolean field is present in the protocol decode only if its value is true. For example, tcp.flags.syn is present, and thus true, only if the SYN flag is present in a TCP segment header.
Thus the filter expression tcp.flags.syn will select only those packets for which this flag exists, that is, TCP segments where the segment header contains the SYN flag. Similarly, to find source-routed token ring packets, use a filter expression of tr.sr.
Ethernet address (6 bytes)
Separators can be a colon (:), dot (.) or dash (-) and can have one or two bytes between separators: ---- eth.dst == ff:ff:ff:ff:ff:ff eth.dst == ff-ff-ff-ff-ff-ff eth.dst == ffff.ffff.ffff ----
ip.addr == 192.168.0.1
Classless InterDomain Routing (CIDR) notation can be used to test if an IPv4 address is in a certain subnet. For example, this display filter will find all packets in the 129.111 Class-B network:
ip.addr == 18.104.22.168/16
ipv6.addr == ::1
http.request.uri == "https://www.wireshark.org/"
You can combine filter expressions in Wireshark using the logical operators shown in Table 6.6, “Display Filter Logical Operations”
Table 6.6. Display Filter Logical Operations
|English||C-like||Description and example|
Substring Operator. Wireshark allows you to select subsequences of a sequence in rather elaborate ways. After a label you can place a pair of brackets  containing a comma separated list of range specifiers. ---- eth.src[0:3] == 00:00:83 ---- The example above uses the n:m format to specify a single range. In this case n is the beginning offset and m is the length of the range being specified. ---- eth.src[1-2] == 00:83 ---- The example above uses the n-m format to specify a single range. In this case n is the beginning offset and m is the ending offset. ---- eth.src[:4] == 00:00:83:00 ---- The example above uses the :m format, which takes everything from the beginning of a sequence to offset m. It is equivalent to 0:m ---- eth.src[4:] == 20:20 ---- The example above uses the n: format, which takes everything from offset n to the end of the sequence. ---- eth.src == 83 ---- The example above uses the n format to specify a single range. In this case the element in the sequence at offset n is selected. This is equivalent to n:1. ---- eth.src[0:3,1-2,:4,4:,2] == 00:00:83:00:83:00:00:83:00:20:20:83 ---- Wireshark allows you to string together single ranges in a comma separated list to form compound ranges as shown above.
Using the != operator on combined expressions like eth.addr, ip.addr, tcp.port, and udp.port will probably not work as expected.
Often people use a filter string to display something like
ip.addr == 22.214.171.124
which will display all packets containing the IP address 126.96.36.199.
Then they use
ip.addr != 188.8.131.52 to see all packets not containing the IP
address 184.108.40.206 in it. Unfortunately, this does not do the expected.
Instead, that expression will even be true for packets where either source or
destination IP address equals 220.127.116.11. The reason for this, is that the
ip.addr != 18.104.22.168 must be read as “the packet contains a field
named ip.addr with a value different from 22.214.171.124”. As an IP datagram contains
both a source and a destination address, the expression will evaluate to true
whenever at least one of the two addresses differs from 126.96.36.199.
If you want to filter out all packets containing IP datagrams to or from IP
address 188.8.131.52, then the correct filter is
!(ip.addr == 184.108.40.206) as it reads
“show me all the packets for which it is not true that a field named ip.addr
exists with a value of 220.127.116.11”, or in other words, “filter out all packets
for which there are no occurrences of a field named ip.addr with the value