The goal of this post
This post is a quick reference for using the display filters in Wireshark. The display filter is used to filter a packet capture file or live traffic, and it is essential to know at least the basics if you want to use Wireshark for troubleshooting and other evaluations.
In this post, I'll focus on the display filters for IPv4 only. Wireshark offers a wide range of tools that are out of this post's scope. IPv6 will be added at some point.
There is no way to list every filter, and I try to concentrate on the most commonly used ones. In general, it is recommended to use the right-click function to add specific protocols/ fields/ values, etc, to the filter.
Nevertheless, a list of all display filters can be found here. I've added links to the specific category to every protocol in the rest of the post.
If you think I forgot something important or want to share more tips, feel free to reach out. I'd appreciate it, and I am happy to learn.
In an attempt to keep it to the basics, I left out topics like functions, variables, macros, arithmetic operators, and some other advanced things. As mentioned before, I'll add IPv6 filters, some more context for when I use certain filters, more topics like OSPF, HTTP/s, and so others, and some more functions.
Difference display filter and capture filter
The capture filter - as the name suggests - is a filter for the capturing of packets itself. With this filter turned on, you can start packet capture, and everything filtered out won't be saved. This is mainly for long packet captures or connections/devices with a lot of traffic helpful, and often enough necessary. Capture filters can have a different syntax and won't be tackled in this post.
The display filter hides filtered packets and is mainly used on already saved packet capture files or live traffic.
Just so you know the difference when you search for more commands.
Saving display filters #
There are two common ways to save filters. They can then be used in later sessions or help you switch between different filters, especially since certain filters can get very long.
Display filter bookmark
Display filter buttons
Color of the display filter bar #
- Filter is accepted, syntax is ok
- Filter is NOT accepted, syntax is wrong
- Filter is accepted, syntax is ok, BUT the filter results might not be clear, e.x. if you reference a field that is present in multiple protocols
- (haven't found too much information about it)
It runs from left to right and can be grouped with parentheses
!ip.src == 10.10.10.1- this would filter out everything with the source IP of
- Side note: read it multiple times, but does not work for me. I just 'craft' something like this:
(x and !y)or(!x and y)
- Not Equal:
- Greater Than:
- Less Than:
- Greater than or Equal to:
- Less than or Equal to:
- Filters for protocol, field, or slice that contains a specific value:
- 'Does the protocol or text string match the given case-insensitive Perl-compatible regular expression':
The following formats are accepted:
option == 1 option == True option == TRUE option == 0 option == False option == FALSE
- I prefer to use the 'raw string' function, instead of fighting with escape characters:
smb.path contains r"\\SERVER\SHARE"
List of escape sequences:
smb.path contains "\\\\SERVER\\SHARE" \' single quote \" double quote \\ backslash \a audible bell \b backspace \f form feed \n line feed \r carriage return \t horizontal tab \v vertical tab \NNN arbitrary octal value \xNN arbitrary hexadecimal value \uNNNN Unicode codepoint U+NNNN \UNNNNNNNN Unicode codepoint U+NNNNNNNN
Time filter #
frame.time >= "Dec 23, 2022 17:00:00" && frame.time <= "Dec 23, 2022 17:05:00"
This filter is a simple time filter. Right-click on
frame.time / Arrival time in the frame, and add it to the filter to work with it. Directly right-clicking on the 'time' column and applying the filter won't work since it inserts another format. I bet you can configure this, but I never bothered to try.
If you want to add more filters, simply put the time segment into parentheses, and add the new filter after or before it.
Side note: I am not sure if I am happy with the following format, and I might change it at some point. It is food enough for now, though.
- You can choose between multiple MAC address formats:
aa-bb-cc-dd-ee-ff# dash delimiter
aa:bb:cc:dd:ee:ff# colon delimiter
aabb.ccdd.eeff# Cisco style
- MAC / Ethernet address:
eth.addr==aa-bb-cc-dd-ee-ff# Source+Destination MAC address
eth.src==aa-bb-cc-dd-ee-ff# Source MAC address
eth.dst==aa-bb-cc-dd-ee-ff# Destination MAC address
- Filter for IP protocol:
- Filter IP addresses:
ip.addr == 10.10.10.10# source+destination IP address
ip.src == 10.10.20.50# source IP address
ip.dst == 10.10.20.50# destination IP address
Side note: You can filter whole subnets with CIDR notation like
- Filter packet TTL:
ip.ttl == 64
- Filter for
- ICMP echo request (ping):
icmp.type == 8
- ICMP echo reply (ping):
icmp.type == 0
- Target MAC address:
- Sender hardware address:
- Target IP address:
- Sender IP address:
- Filter for TCP:
- Filter TCP ports:
tcp.port == 53# source+destination TCP port
tcp.srcport == 68# source TCP port
tcp.dstport == 68# destination TCP port
Side note: filtering 'TCP streams' is helpful, but it is easier to right click on the TCP segment, and filter there instead of tpying in a filter.
- General troubleshooting for packet loss:
tcp.analysis.flags && !tcp.analysis.window_update
- displays all retransmissions, duplicate ACKs, other TCP errors. I'll use this in combination with IP filters to get a feeling for the connection quality.
- Look for 3-way-handshakes:
((tcp.flags == 0x02) || (tcp.flags == 0x12) ) || ((tcp.flags == 0x10) && (tcp.ack==1) && (tcp.len==0))
- Fitlers for TCP resets flag:
- Filter for UDP:
- Filter UDP ports:
udp.port == 53# source+destination UDP port
udp.srcport == 68# source UDP port
udp.dstport == 68# destination UDP port
- Filter for dhcp
- Filter for type (DORA)
dhcp.option.dhcp == 1# Discover
dhcp.option.dhcp == 2# Offer
dhcp.option.dhcp == 3# Request
dhcp.option.dhcp == 5# Discover
- Search for
dhcp.option.hostname == "pleasejustwork"
- Seach for various options:
dhcp.option.type == 3# Search for a specific option number
dhcp.option.dhcp_server_id == 10.10.20.1# Option: (54) DHCP Server Identifier
dhcp.option.type == 51# Option: (51) IP Address Lease Time
dhcp.option.subnet_mask == 255.255.255.0# Option: (1) Subnet Mask (255.255.255.0)
dhcp.option.router == 10.10.20.1# Option: (3) Router
dhcp.option.domain_name_server == 220.127.116.11# Option: (6) Domain Name Server
- I won't list all of them, but you can find all options here.
- Search for a DHCP discover message of specific MAC address:
(dhcp.hw.mac_addr == aa:bb:cc:dd:ee:ff) && (dhcp.option.dhcp == 1)
(eth.src == aa:bb:cc:dd:ee:ff) && (dhcp.option.dhcp == 1)
- Finding rogue DHCP server:
dhcp && !dhcp.option.dhcp == 1 && !dhcp.option.dhcp_server_id == 10.10.20.1
- it is DHCP, it is not a discover message, and is not our DHCP server for this network
(udp.dstport == 68) && !(dhcp.option.dhcp_server_id == 10.10.20.1)
- this is another option to check for the dst port '68' and filter out our DHCP server
- Check if other DNS server are getting populated:
dhcp.option.dhcp == 2 && !(dhcp.option.domain_name_server == 18.104.22.168) && !(dhcp.option.domain_name_server == 22.214.171.124)
- Filter for DNS queries:
- Filter for DNS queries:
dns.flags.response == 0
- Filter for DNS responses:
dns.flags.response == 1
- Filter the domain on the DNS quieries:
dns.qry.name == "ittavern.com"# Discover
- Filter common DNS records:
dns.qry.type == 1#
dns.qry.type == 28#
dns.qry.type == 16#
dns.qry.type == 5#
dns.qry.type == 33#
dns.qry.type == 15#
dns.qry.type == 2#
- Filter for the DNS server answer:
dns.a == 126.96.36.199# answer of a
dns.txt == "v=spf1 include:spf.protection.outlook.com -all"# answer of a
- and so on
- Look up what DNS servers are used:
(ip.dst == 10.64.0.1) && (dns)
- Show only DNS traffic of one client:
dns && (ip.dst==10.10.20.1 or ip.src==10.10.20.1)
- Check for slow responses:
dns.flags.rcode == 0 && dns.time > .3# might needs some fine tuning depending on the env
- Show DNS requests that couldn't be resolved:
dns.flags.rcode != 0
E-Mail hello @itta vern. com
- 04.08.2023 Getting started with Fail2Ban on Linux
- 23.07.2023 Getting started with netcat on Linux with examples
- 06.07.2023 URL explained - The Fundamentals
- 22.06.2023 Troubleshooting: Asking The Right Questions
- 16.06.2023 Create tmux layouts using bash scripts