The Best Wireshark Filters

Wireshark, formerly Ethereal, is a powerful open-source program that helps users monitor and analyze information traveling to and from a specific network. The software can process complex data from hundreds of protocols on most network types, organizing it into data packets. However, when the network unexpectedly crashes or runs into problems, searching through the packets can be overwhelming, requiring a lot of time and energy. That’s where Wireshark’s user-friendly nature comes in handy.

The software supports filters that allow you to quickly sift through large amounts of information. Instead of inspecting captured files manually, you can apply a filter that will take you to the data you want to check.

Read on to learn about the best Wireshark filters and how to bookmark them for later use.

Wireshark Filters

There are two types of filters in Wireshark. The first is capture filters, while the other is display filters. The two operate on a different syntax and serve specific purposes.

Capture filters are established before initiating a capturing operation. The parameters of capture filters only record and store traffic you’re interested in analyzing. Once the capture operation begins, modifying this type of filter is impossible.

On the other hand, display filters contain parameters that apply to all captured packets. You can set this type of filter before initiating a capture operation and later adjust or cancel it. Also, you can establish it while the operation is in progress. A display filter keeps data within a trace buffer, hiding the traffic you’re disinterested in and displaying only the information you wish to view.

Wireshark has an impressive library of built-in filters to help users better monitor their networks. To access and use an existing filter, you must type the correct name in the “Apply a display filter” section underneath the program’s toolbar. When you want to find and apply a capture filter, use the “Enter a capture” section in the middle of the welcome screen.

Although Wireshark boasts comprehensive filtering capabilities, remembering the correct syntax often gets tricky. When you struggle to type the appropriate filter, you waste valuable time.

But you’re in luck. We’ve compiled a list of the best Wireshark filters to help you use the program more efficiently and take the guesswork out of analyzing piles of saved data.

Best Wireshark Filters

Let’s look at several helpful filters that will allow you to master the program.

ip.addr == x.x.x.x

The above filter will only bring up captured packets that include the set IP address. It’s a handy tool for inspecting one kind of traffic. Applying the filter will process outgoing traffic and determine which one aligns with the source or IP you’re searching for.

If you want to filter by destination, use the ip.dst == x.x.x.x variant.

The ip.src == x.x.x.x variant helps you filter by source.

ip.addr == x.x.x.x && ip.addr == x.x.x.x

This string establishes a conversation filter going between two preset IP addresses. It’s invaluable for checking data between two selected networks or hosts. The filter ignores unnecessary data and only focuses on finding information that interests you the most.

For destination filtering, use the ip.src == xxxx && ip.dst == xxxx string.

http or dns

When you apply this filter, it will display every dns or http protocol. It’s a time-saving filter that lets you zero in on a specific protocol you want to examine. For example, if you need to find suspicious FTP traffic, all you need to do is set the filter for “ftp.” To learn why a web page fails to appear, set the filter to “dns.”

tcp.port==xxx

The above filter narrows down your search to a specific destination port or source. Instead of going through an entire captured package, the filter generates data regarding traffic going into or from a single port. It’s one of the most convenient filters you can rely on to complete your task if you’re in a time crunch.

tcp.flags.reset==1

Applying this filter will show every TCP reset. Each captured packet has an associated TCP. When its value is set to one, it alerts the receiving PC that it should stop operating on that connection. This is one of the most impressive Wireshark filters since a TCP reset terminates the connection instantly.

tcp contains xxx

This filter will find all TCP capture packets that include the specified term. If you’re curious where the item appears within a capture, type its name instead of “xxx.” The filter will locate all instances of the term, sparing you from reading through the package. For example, when you replace “xxx” with “traffic,” you’ll see all packets containing “traffic.” It’s best to use this filter to scan a specific user ID or string.

!(arp or icmp or dns)

The above filter is designed to exclude specific protocols. Use it to remove arp, dns, or icmp protocol you don’t need. It lets you block distracting data so that you can focus on analyzing more urgent information.

tcp.time_delta > .250

This filter displays TCP packets with a delta time above 250 mSec within their stream.

Remember that before using the filter, you’ll need to calculate the TCP Conversion Timestamp. While calculating delays in conversations isn’t too challenging, it requires some advanced Wireshark knowledge.

tcp.analysis.flags && !tcp.analysis.window_update

This filter helps you view retransmissions, zero windows, and duplicate attacks in a single trace. It’s an excellent way of finding lackluster app performances or packet losses.

Tips for Using Wireshark Filters

Failing to remember the correct syntax of a filter is frustrating and can prevent you from finding valuable data quickly.

Sometimes, Wireshark’s autocompleting feature can help you resolve the issue. For example, if you’re sure the filter starts with “tcp,” type this information into the appropriate search field. Wireshark will generate a list of filters beginning with “tcp.” Go down the search results until you find the correct moniker.

Another way to find filters is the “bookmark” option next to the entry field. When you select “Manage Display Filters” or “Manage Filter Expressions,” you can modify, add, or remove filters. If you’re not especially confident about remembering complex syntax abbreviations, the “bookmark” option is a hassle-free tool for retrieving frequently used Wireshark filters.

Instead of retyping complex capture filters, follow the steps below to save them in the “bookmark” menu:

1. Launch Wireshark and navigate to the “bookmark” option.
   
2. Click on “Manage Display Filters” to view the dialogue box.
   
3. Find the appropriate filter in the dialogue box, tap it, and press the “+” button to save it.
   

Here’s what you need to do to save a display filter:

1. Open Wireshark and go to the “bookmark” option.
   
2. Choose “Manage Display Filters” to open the dialogue window.
   
3. Scan the list of options, double-tap the appropriate filter, and click on the “+” button to save it as a bookmark.
   

If you’re in a hurry to analyze specific data, you might want to press the down arrow beside the entry field. The action will generate a list of previously used filters.

Use Filters for Hassle-Free Data Analysis

Wireshark has become one of the most popular network protocol analyzers, thanks to its handy filters. You can use them to save time and quickly locate specific parameters like IP addresses or HEX values. If you struggle to remember the different monikers of your frequently used filters, save them as bookmarks for later use.

How often do you use Wireshark filters? Which do you rely on more, capture or display filters? Have you ever used some of the options mentioned above? Let us know in the comments section below.