Post cover image

September 20, 2026

Part 3 — Wireshark Display Filters: Finding What Matters in Thousands of Packets

A Beginner’s Guide to Filtering, Investigating and Finding Interesting Network Traffic

By ghostyjoe

18 min read

A Beginner's Guide to Filtering, Investigating and Finding Interesting Network Traffic

If you have followed Part 1 and Part 2, you can now capture packets and understand the basic information Wireshark is showing you.

But there is a problem.

A busy network can generate thousands — or even millions — of packets.

Trying to manually examine every packet is not practical.

This is where one of Wireshark's most important features comes in:

Display filters.

Display filters allow you to hide packets you aren't interested in and concentrate on the traffic that matters.

You can filter by:

  • IP address
  • Protocol
  • Port
  • DNS name
  • TCP flags
  • Packet size
  • HTTP requests
  • HTTP response codes
  • TCP problems
  • Packet contents
  • Fields inside protocols
  • Combinations of multiple conditions

Wireshark's current display-filter system provides an enormous number of protocol fields to work with; the official 4.6.8 reference lists more than 328,000 fields across around 3,000 protocols. (Wireshark)

So in this article, we're going to start with the basics and gradually build toward filters that are useful for real network troubleshooting and security analysis.

🔙 Before We Start

If you haven't read the previous article, start with Part 1:

Part 1 — Wireshark: The Complete Beginner's Guide to Network Traffic Analysis

👉 Read Part 1: https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/wireshark-the-complete-beginners-guide-to-network-traffic-analysis-44771b1bf542

In Part 1, we installed Wireshark, captured traffic and learned the basic interface.

In Part 2, we learned how to understand packets, Ethernet, ARP, IPv4, TCP, DNS, ICMP and other protocol layers.

Now we're going to learn how to find specific packets quickly.

1. What Is a Wireshark Display Filter?

A display filter is an expression that tells Wireshark:

"Only show me packets that match these conditions."

For example:

tcp

will display TCP traffic.

Instead of seeing everything in the capture:

ARP
DNS
TCP
UDP
ICMP
TLS
DHCP
IPv6
TCP
DNS
ARP
...

you might see only:

TCP
TCP
TCP
TCP
TCP

The packets haven't been deleted.

They are simply hidden from the current display.

This distinction is extremely important.

Wireshark has two different filtering systems:

  • Capture filters — determine what gets captured.
  • Display filters — determine what is displayed after capture.

They use different syntax. (Wireshark)

2. Capture Filters vs Display Filters

This causes confusion for many beginners.

Capture filter

A capture filter is applied before or during packet capture.

It can reduce what Wireshark actually records.

Display filter

A display filter is applied after packets have been captured.

It simply controls what you currently see.

Think of it like this:

NETWORK
   │
   ▼
PACKETS
   │
   ▼
WIRESHARK CAPTURE
   │
   ├── Capture Filter
   │
   ▼
CAPTURED PACKETS
   │
   ├── Display Filter
   │
   ▼
PACKETS YOU WANT TO ANALYZE

For this article, we're concentrating on display filters.

3. Where Do You Enter a Display Filter?

At the top of the Wireshark window you'll find the Display Filter toolbar.

Depending on your Wireshark version and interface, it appears above the packet list.

You can enter a filter such as:

tcp

and press Enter.

Wireshark will immediately update the packet list.

Figure 1 — The Wireshark Display Filter toolbar

Screenshot to capture: Show Wireshark with the display-filter field highlighted and tcp entered.

None

Figure 1 — The Wireshark Display Filter toolbar allows you to narrow a packet capture to traffic matching a specific condition.

4. Your First Filter: tcp

Let's start with the simplest possible example.

Enter:

tcp

Press Enter.

Wireshark will display packets identified as TCP.

This is useful when you're investigating:

  • Web traffic
  • HTTPS connections
  • SSH
  • FTP
  • Database connections
  • TCP connection problems
  • TCP retransmissions
  • TCP handshakes

The filter doesn't mean:

"Show packets using TCP port 80."

It means:

"Show packets containing the TCP protocol."

5. Filtering UDP

To display UDP packets:

udp

This can be useful when investigating:

  • DNS
  • DHCP
  • VoIP
  • QUIC
  • Streaming traffic
  • UDP-based applications

For example:

udp

will immediately remove TCP, ARP and other unrelated traffic from the visible packet list.

6. Filtering DNS

To show DNS packets:

dns

This is one of the most useful filters for beginners.

You can use it when investigating:

  • Domain lookups
  • DNS troubleshooting
  • Unexpected domain requests
  • Failed name resolution
  • Repeated DNS queries
  • DNS-related network activity

7. Filtering ARP

To show ARP:

arp

This is useful when investigating local-network address resolution.

For example, you might see:

Who has 192.168.1.1?

followed by:

192.168.1.1 is at XX:XX:XX:XX:XX:XX

This connects directly to what we learned in Part 2.

8. Filtering ICMP

For ping and other ICMP traffic:

icmp

You can then see Echo Requests and Echo Replies.

For example:

192.168.1.10 → 8.8.8.8
8.8.8.8 → 192.168.1.10

This is extremely useful for troubleshooting connectivity.

9. Filtering by IP Address

Now things get much more interesting.

Suppose your computer has the address:

192.168.1.10

You can use:

ip.addr == 192.168.1.10

This displays IPv4 traffic where the address appears as either the source or destination.

The official Wireshark reference defines ip.addr as the IPv4 source or destination address. (Wireshark)

10. Source IP vs Destination IP

You can be more specific.

Traffic coming FROM an IP

ip.src == 192.168.1.10

This shows packets where:

Source = 192.168.1.10

Traffic going TO an IP

ip.dst == 192.168.1.10

This shows packets where:

Destination = 192.168.1.10

Either direction

ip.addr == 192.168.1.10

This is often the most convenient option when investigating a particular host.

11. Finding Traffic Between Two IP Addresses

Suppose you want to investigate communication between:

192.168.1.10

and:

192.168.1.50

You could use:

ip.addr == 192.168.1.10 && ip.addr == 192.168.1.50

This requires both addresses to be present in the packet.

This is extremely useful when investigating a conversation between two systems.

12. Understanding ==

The operator:

==

means:

equals

For example:

ip.src == 192.168.1.10

means:

Show packets where the source IPv4 address equals 192.168.1.10.

Wireshark also supports English-style comparison operators such as eq, ne, gt, lt, ge, and le. (Wireshark)

For beginners, I recommend learning the familiar symbols first:

==
!=
>
<
>=
<=

13. Finding a Specific TCP Port

Ports are another extremely useful filtering method.

For example:

tcp.port == 443

This displays TCP traffic involving port 443.

Port 443 is commonly associated with HTTPS.

Other examples include:

tcp.port == 80

HTTP

tcp.port == 22

SSH

tcp.port == 25

SMTP

tcp.port == 3389

Remote Desktop Protocol

Remember that a port number alone does not guarantee what application is actually running there. Ports are conventions, not proof of application identity.

14. Source and Destination Ports

You can become more precise.

Source port

tcp.srcport == 443

Destination port

tcp.dstport == 443

This lets you distinguish the direction of the connection.

For example:

tcp.dstport == 443

can help identify traffic being sent toward a TCP service on port 443.

15. Combining IP and Port Filters

This is where display filters become extremely powerful.

Suppose you want traffic from:

192.168.1.10

to TCP port:

443

Use:

ip.src == 192.168.1.10 && tcp.dstport == 443

Now Wireshark has to satisfy both conditions.

This dramatically reduces the amount of traffic you need to inspect.

16. Understanding &&

The operator:

&&

means:

AND

For example:

tcp && ip.addr == 192.168.1.10

means:

Show TCP packets AND packets involving 192.168.1.10.

You can combine several conditions:

tcp && ip.addr == 192.168.1.10 && tcp.port == 443

Now you're asking for:

TCP traffic involving this IP and port 443.

17. Using || — OR

The operator:

||

means:

OR

For example:

dns || icmp

means:

Show DNS packets OR ICMP packets.

You can also combine protocols:

tcp || udp

This displays both TCP and UDP traffic.

18. Using ! — NOT

The exclamation mark:

!

means:

NOT

For example:

!arp

means:

Show packets that aren't ARP.

You can also write:

not arp

Wireshark supports both symbolic and English-style logical operators. (Wireshark)

19. Combining AND, OR and NOT

You can create much more specific filters.

For example:

tcp && !(tcp.port == 443)

This means:

Show TCP traffic that isn't using port 443.

Parentheses become important when filters become complicated.

For example:

ip.addr == 192.168.1.10 && (tcp.port == 80 || tcp.port == 443)

This means:

Show traffic involving 192.168.1.10 where the TCP port is either 80 or 443.

20. Filtering TCP SYN Packets

Remember the TCP three-way handshake from Part 2?

It starts with:

SYN

You can find SYN packets using:

tcp.flags.syn == 1

But this will also match SYN packets that have the ACK flag set.

To find the initial SYN more specifically:

tcp.flags.syn == 1 && tcp.flags.ack == 0

This is useful when looking for connection attempts.

For example:

Client → Server
[SYN]
Server → Client
[SYN, ACK]
Client → Server
[ACK]

The first packet is what we're looking for.

Wireshark's documentation specifically notes that a Boolean field such as tcp.flags.syn must be compared with 1 or True when you want the flag set. (Wireshark)

21. Finding TCP SYN/ACK Packets

To find SYN/ACK packets:

tcp.flags.syn == 1 && tcp.flags.ack == 1

This can be useful when troubleshooting:

  • Failed connections
  • Unexpected connection attempts
  • Services that are responding
  • Connection scanning
  • Firewall behavior

Again, seeing a packet matching a filter does not automatically mean malicious activity.

Context matters.

22. Finding TCP Retransmissions

One of Wireshark's most useful troubleshooting filters is:

tcp.analysis.retransmission

This can highlight packets Wireshark has identified as TCP retransmissions.

Retransmissions can occur because of:

  • Packet loss
  • Congestion
  • Poor connectivity
  • Wireless interference
  • Network problems
  • Delayed acknowledgements
  • Other TCP conditions

A retransmission is therefore an investigation clue, not automatically evidence of an attack.

23. Finding TCP Reset Packets

TCP reset packets can be interesting when troubleshooting connections.

Use:

tcp.flags.reset == 1

This can help identify connections being reset.

For example, you might investigate why:

Client → Server
RST

appears instead of a normal TCP connection or termination.

24. Finding DNS Queries for a Specific Domain

Wireshark allows you to filter fields inside protocols.

For DNS query names, you can use:

dns.qry.name

The official display-filter reference identifies dns.qry.name as the DNS query name field. (Wireshark)

For example:

dns.qry.name == "example.com"

You can also search for names containing text:

dns.qry.name contains "example"

This can be useful when looking through a large DNS capture.

25. The contains Operator

The contains operator searches for a value inside a protocol, field or byte sequence. (Wireshark)

For example:

dns.qry.name contains "google"

could help locate DNS queries containing the word:

google

Another example:

http contains "login"

can search HTTP traffic for that string where the protocol data is available to Wireshark.

Important

contains is not magic.

It does not decrypt encrypted traffic.

If the relevant application data is protected by TLS, you generally won't be able to search the encrypted payload for ordinary plaintext strings.

26. Searching HTTP Requests

If you're working with unencrypted HTTP traffic, you can use:

http.request

This filters for HTTP requests.

You can become more specific:

http.request.method == "GET"

or:

http.request.method == "POST"

The current Wireshark HTTP display-filter reference includes fields such as http.request, http.request.method, http.request.uri, and http.request.full_uri. (Wireshark)

27. Finding a Specific HTTP Host

You can investigate HTTP host information with fields available under the HTTP protocol.

For example, depending on the capture:

http.host == "example.com"

This can help isolate requests to a particular HTTP host.

Again, this is primarily useful with traffic Wireshark can actually dissect as HTTP.

Modern HTTPS traffic is encrypted, so you should not expect ordinary HTTP filters to expose encrypted web content.

28. Finding HTTP Errors

HTTP response codes can also be useful.

For example:

http.response.code >= 400

This can help locate HTTP error responses.

You can narrow it further:

http.response.code == 404

for HTTP 404 responses.

Or:

http.response.code == 500

for HTTP 500 responses.

This can be extremely useful when troubleshooting web applications.

29. Finding Large Packets

You can filter based on packet size.

For example:

frame.len > 1000

This asks Wireshark to display frames larger than 1000 bytes.

You could also use:

frame.len > 1400

to investigate larger frames.

Comparison operators such as >, <, >=, and <= are supported by the display-filter engine. (Wireshark)

30. Finding Small Packets

The opposite is just as easy.

frame.len < 100

This can be useful when examining:

  • Control traffic
  • TCP acknowledgements
  • Small DNS packets
  • Keepalives
  • Network discovery traffic

Don't assume that a small packet is unimportant.

Some of the most useful information in a capture can be contained in very small packets.

31. Filtering by TCP Stream

One of my favorite filters for beginners is:

tcp.stream eq 0

A TCP stream represents one TCP conversation.

When you identify an interesting connection, filtering on its stream number can isolate that conversation from everything else happening in the capture.

You may see:

Client → Server
SYN
Server → Client
SYN/ACK
Client → Server
ACK
Client → Server
Data
Server → Client
Data
...

This gives you a much clearer picture of what happened during that connection.

32. Follow TCP Stream vs tcp.stream

These two features work together but aren't exactly the same.

Follow TCP Stream

Right-click a TCP packet and choose:

Follow → TCP Stream

Wireshark attempts to reconstruct the conversation.

Display filter

You can also use:

tcp.stream eq 0

to display packets belonging to a particular TCP stream.

This is especially useful when you want to investigate one connection while keeping Wireshark's normal packet-analysis interface.

33. Filtering by Protocol and IP Together

A very practical example:

dns && ip.addr == 192.168.1.10

This means:

Show DNS traffic involving 192.168.1.10.

Another:

icmp && ip.addr == 192.168.1.10

means:

Show ICMP traffic involving that machine.

And:

tcp && ip.addr == 192.168.1.10

means:

Show TCP traffic involving that machine.

These simple combinations are extremely useful in real investigations.

34. Building a Filter Step by Step

Don't try to write complicated filters immediately.

Build them.

Start with:

tcp

Then:

tcp && ip.addr == 192.168.1.10

Then:

tcp && ip.addr == 192.168.1.10 && tcp.port == 443

Then perhaps:

tcp && ip.addr == 192.168.1.10 && tcp.port == 443 && tcp.flags.syn == 1

This approach makes troubleshooting your filter much easier.

If the final filter returns nothing, you can work backwards and identify which condition caused the problem.

35. Using Wireshark's Filter Autocomplete

You don't need to memorize every field.

Start typing in the display-filter field.

For example:

tcp.

Wireshark can provide available fields and functions.

Try:

ip.
dns.
tcp.
http.

This is one of the best ways for beginners to learn Wireshark's filter language.

The official Display Filter Reference can also be used when you need to find a particular field. (Wireshark)

36. A Beginner's Display Filter Cheat Sheet

Here are some filters worth saving.

GoalFilterTCPtcpUDPudpDNSdnsARParpICMPicmpIPv4ipIPv6ipv6Specific IPip.addr == 192.168.1.10Source IPip.src == 192.168.1.10Destination IPip.dst == 192.168.1.10TCP porttcp.port == 443UDP portudp.port == 53TCP SYNtcp.flags.syn == 1Initial SYNtcp.flags.syn == 1 && tcp.flags.ack == 0SYN/ACKtcp.flags.syn == 1 && tcp.flags.ack == 1TCP RSTtcp.flags.reset == 1TCP retransmissionstcp.analysis.retransmissionDNS namedns.qry.name == "example.com"DNS containsdns.qry.name contains "example"HTTP requestshttp.requestHTTP GEThttp.request.method == "GET"HTTP POSThttp.request.method == "POST"HTTP errorshttp.response.code >= 400Large framesframe.len > 1000TCP streamtcp.stream eq 0TCP OR UDPtcpExclude ARP!arp`

37. Five Filters I Recommend Learning First

If you're completely new to Wireshark, don't try to memorize 100 filters.

Start with these five:

1. Find one computer

ip.addr == 192.168.1.10

2. Find TCP traffic

tcp
tcp.port == 443

4. Find DNS

dns

5. Find TCP retransmissions

tcp.analysis.retransmission

Once these become familiar, start combining them.

38. Practical Example — Investigating One Computer

Imagine you have captured 50,000 packets.

You want to investigate:

192.168.1.10

Start with:

ip.addr == 192.168.1.10

Perhaps you now have 12,000 packets.

Next:

ip.addr == 192.168.1.10 && tcp

Now perhaps you have 8,000.

Then:

ip.addr == 192.168.1.10 && tcp.port == 443

Now you're looking at HTTPS-related TCP traffic involving that system.

You can then inspect:

  • Source
  • Destination
  • TCP flags
  • Timing
  • Retransmissions
  • TCP streams
  • TLS information
  • Packet sizes

This is how filtering turns a huge capture into something manageable.

39. Practical Example — Investigating DNS

Start with:

dns

Then perhaps:

dns && ip.addr == 192.168.1.10

Then:

dns.qry.name

Or a specific domain:

dns.qry.name == "example.com"

Or a partial match:

dns.qry.name contains "example"

Now you can start asking questions:

  • Which domains were queried?
  • Which computer made the request?
  • Which DNS server answered?
  • Did the request receive a response?
  • What IP address was returned?
  • Were requests repeated?
  • Did the response contain an error?

This is where Wireshark starts becoming a genuine investigation tool rather than simply a packet viewer.

40. Practical Example — Investigating TCP Connections

Start with:

tcp

Then look for initial SYN packets:

tcp.flags.syn == 1 && tcp.flags.ack == 0

You can then examine:

  • Source IP
  • Destination IP
  • Destination port
  • Timing
  • Number of connection attempts
  • Whether the server responds

For example, repeated connection attempts toward a particular service might deserve further investigation.

But remember:

A packet pattern is evidence for investigation, not proof of malicious activity.

Network conditions, applications, automated services and legitimate administration can all produce unusual-looking traffic.

41. Practical Example — Finding Network Problems

Suppose a user reports:

"The connection is slow."

Instead of looking at thousands of packets manually, try:

tcp.analysis.retransmission

Then investigate:

tcp.analysis.retransmission && ip.addr == 192.168.1.10

You can then examine:

  • Which destination is involved?
  • Which TCP stream?
  • How frequently are retransmissions occurring?
  • Are they concentrated around a particular connection?
  • Are there other TCP analysis indicators?

This turns a vague complaint into something measurable.

42. Display Filters Do Not Automatically Explain What Happened

This is an important lesson.

Suppose you filter:

tcp.flags.reset == 1

and find 50 RST packets.

That does not automatically mean:

"Someone is attacking the network."

It means:

"Wireshark identified 50 packets with the TCP reset flag set."

You still need to investigate:

  • Who sent them?
  • Who received them?
  • Which ports?
  • Which streams?
  • What happened immediately before them?
  • What happened afterward?
  • Is the behavior expected?

Good network analysis is about context.

43. Don't Ignore the Packets You Filtered Out

A display filter hides packets from the current view.

It doesn't erase them from the capture.

This means you can experiment.

For example:

dns

Then remove the filter.

Then:

tcp

Then:

icmp

You can move between different views of the same capture.

This is one reason display filters are so useful for learning.

44. Filter Before You Analyze

A good workflow is:

1. Capture traffic
        ↓
2. Get an overview
        ↓
3. Identify the protocol of interest
        ↓
4. Apply a display filter
        ↓
5. Identify an interesting packet
        ↓
6. Inspect Packet Details
        ↓
7. Follow the conversation/stream
        ↓
8. Build a more precise filter
        ↓
9. Compare related packets
        ↓
10. Draw conclusions

Don't immediately jump into complicated filters.

Start broad.

Then narrow your investigation.

45. Figure 2 — Filtering for a Specific IP Address

Screenshot to capture:

Enter:

ip.addr == 192.168.1.10

Show the resulting packet list with the filter visible.

None

Figure 2 — Filtering a capture to display only IPv4 traffic involving a specific host.

46. Figure 3 — Combining Multiple Conditions

Screenshot to capture:

Use:

ip.addr == 192.168.1.10 && tcp.port == 443

Show the reduced packet list.

None

Figure 3 — Combining IP and TCP port conditions to isolate HTTPS-related traffic from a specific host.

47. Figure 4 — Finding TCP SYN Packets

Screenshot to capture:

Use:

tcp.flags.syn == 1 && tcp.flags.ack == 0

Show the resulting TCP connection attempts.

None

Figure 4 — Filtering Wireshark traffic to identify initial TCP SYN packets used to begin connections.

48. Figure 5 — Filtering DNS Queries

Screenshot to capture:

Use:

dns

Then select a DNS packet and expand the DNS section in Packet Details.

None

Figure 5 — Filtering a capture to DNS traffic and examining a DNS query in Wireshark.

49. Figure 6 — Finding TCP Retransmissions

Screenshot to capture:

Use:

tcp.analysis.retransmission

Highlight one of the resulting packets and show the TCP Analysis section.

None

Figure 6 — Using Wireshark's TCP analysis fields to locate packets identified as retransmissions.

50. Figure 7 — Filtering an Individual TCP Stream

Screenshot to capture:

Use something similar to:

tcp.stream eq 0

Show the packets belonging to one TCP conversation.

None

Figure 7 — Isolating one TCP stream to examine the packets belonging to a single network conversation.

51. Figure 8 — Building a Complex Filter

For the final screenshot, use:

ip.addr == 192.168.1.10 && (tcp.port == 80 || tcp.port == 443)

This demonstrates how multiple conditions can be combined.

None

Figure 8 — Combining multiple display-filter conditions to isolate HTTP and HTTPS-related TCP traffic for a specific host.

52. A Simple Beginner Investigation

Let's put everything together.

Imagine you have a capture containing:

25,000 packets

You want to investigate one computer.

Step 1 — Find the computer

ip.addr == 192.168.1.10

Step 2 — Look at DNS

ip.addr == 192.168.1.10 && dns

Step 3 — Look at HTTPS

ip.addr == 192.168.1.10 && tcp.port == 443

Step 4 — Look for connection attempts

ip.addr == 192.168.1.10 && tcp.flags.syn == 1 && tcp.flags.ack == 0

Step 5 — Look for retransmissions

ip.addr == 192.168.1.10 && tcp.analysis.retransmission

Step 6 — Pick an interesting TCP stream

Suppose Wireshark tells you it is:

tcp.stream = 14

Then:

tcp.stream eq 14

Now you're investigating one specific conversation.

That's a huge reduction from 25,000 packets.

53. Common Beginner Mistakes

Mistake 1 — Confusing capture and display filters

They are different filtering languages.

Don't assume a capture filter can simply be pasted into the display-filter box.

Mistake 2 — Using = instead of ==

For comparisons, use:

==

For example:

ip.addr == 192.168.1.10

Mistake 3 — Forgetting parentheses

A complex filter such as:

ip.addr == 192.168.1.10 && (tcp.port == 80 || tcp.port == 443)

is much easier to understand than a complicated expression without grouping.

Mistake 4 — Assuming no results means something is broken

Your filter may simply be too specific.

Start with:

tcp

Then gradually add conditions.

Mistake 5 — Assuming every TCP error means an attack

Retransmissions, resets and unusual traffic can have many legitimate causes.

Investigate the surrounding traffic before reaching conclusions.

54. The Most Important Skill: Ask Questions

Don't use filters simply because you know the syntax.

Use them to answer questions.

For example:

Question:

What traffic is this computer generating?

ip.src == 192.168.1.10

Question:

Who is communicating with this computer?

ip.addr == 192.168.1.10

Question:

What DNS queries is it making?

ip.addr == 192.168.1.10 && dns

Question:

Is it making HTTPS connections?

ip.addr == 192.168.1.10 && tcp.port == 443

Question:

Are there TCP retransmissions?

ip.addr == 192.168.1.10 && tcp.analysis.retransmission

Question:

Which connections begin with SYN packets?

tcp.flags.syn == 1 && tcp.flags.ack == 0

That is the mindset of a network analyst.

55. Wireshark Display Filters for Security Analysis

Display filters are also extremely useful when performing authorized security analysis.

For example, during an authorized assessment or lab exercise, you might use filters to investigate:

DNS activity
TCP connection attempts
Unexpected services
Repeated connections
TCP retransmissions
HTTP requests
Suspicious-looking DNS names
Unexpected protocols

But remember:

Wireshark is an analysis tool. A filter result is not automatically a security finding.

You need to understand the environment and validate what you are seeing.

Only capture or analyze traffic you are authorized to inspect.

56. A Useful Mental Model

When you see a large capture, don't think:

"I have to inspect thousands of packets."

Think:

"What question am I trying to answer?"

Then build a filter around that question.

For example:

WHO?
    ↓
ip.addr
WHAT PROTOCOL?
    ↓
tcp / udp / dns / icmp / http
WHICH SERVICE?
    ↓
tcp.port / udp.port
WHAT EVENT?
    ↓
tcp.flags / dns fields / http fields
WHICH CONVERSATION?
    ↓
tcp.stream

This approach makes Wireshark much easier to use.

57. Part 3 Challenge

Now it's your turn.

Open a capture containing normal network traffic.

Try these filters one at a time:

Challenge 1

dns

Identify:

  • The DNS server
  • The queried domain
  • The response

Challenge 2

tcp

Find a TCP connection.

Challenge 3

tcp.flags.syn == 1 && tcp.flags.ack == 0

Find an initial TCP SYN.

Challenge 4

tcp.analysis.retransmission

See whether Wireshark identifies any retransmissions.

Challenge 5

Choose an interesting TCP packet and identify its:

tcp.stream

Then filter that stream.

Challenge 6

Create your own filter combining:

IP address
+
protocol
+
port

If you can do that, you're already moving beyond the absolute beginner stage.

58. Display Filter Cheat Sheet

Save this section.

# Protocols
tcp
udp
dns
arp
icmp
ip
ipv6
# IP addresses
ip.addr == 192.168.1.10
ip.src == 192.168.1.10
ip.dst == 192.168.1.10
# Ports
tcp.port == 443
tcp.srcport == 443
tcp.dstport == 443
udp.port == 53
# Logic
tcp && dns
tcp || udp
!arp
# TCP flags
tcp.flags.syn == 1
tcp.flags.syn == 1 && tcp.flags.ack == 0
tcp.flags.syn == 1 && tcp.flags.ack == 1
tcp.flags.reset == 1
# TCP analysis
tcp.analysis.retransmission
# TCP streams
tcp.stream eq 0
# DNS
dns.qry.name == "example.com"
dns.qry.name contains "example"
# HTTP
http.request
http.request.method == "GET"
http.request.method == "POST"
http.response.code >= 400
# Packet size
frame.len > 1000
frame.len < 100
# Combining conditions
ip.addr == 192.168.1.10 && tcp.port == 443
ip.addr == 192.168.1.10 && (tcp.port == 80 || tcp.port == 443)

59. What You've Learned

By completing Part 3, you should now understand that Wireshark filters allow you to move from:

"There are thousands of packets."

to:

"Show me only the packets relevant to my question."

You've learned how to filter by:

  • Protocol
  • IPv4 address
  • Source and destination
  • TCP and UDP ports
  • TCP flags
  • TCP streams
  • DNS names
  • HTTP requests
  • HTTP response codes
  • Packet size
  • TCP analysis information

You've also learned how to combine conditions using:

&&
||
!

and how to use:

==
!=
>
<
>=
<=
contains

Wireshark's display-filter engine supports comparisons, field existence tests, logical expressions and operators such as contains and matches, making filters considerably more powerful than simple protocol searches. (Wireshark)

60. What's Next?

We've now gone from:

Part 1

Installing Wireshark and capturing traffic

to:

Part 2

Understanding packets, protocols and network layers

to:

Part 3

Filtering thousands of packets down to the traffic that matters

But filtering is only the beginning.

In the next part, we'll start using Wireshark to follow conversations and reconstruct network activity.

We'll look at:

  • Follow TCP Stream
  • TCP conversations
  • UDP conversations
  • Stream numbers
  • Client/server communication
  • Reconstructing application traffic
  • HTTP requests and responses
  • Understanding encrypted TLS connections
  • Finding the beginning and end of conversations
  • Investigating suspicious connections
  • Using stream analysis during troubleshooting

🦈 Final Thoughts

Wireshark can look intimidating because it exposes an enormous amount of information.

But you don't need to understand everything at once.

Start with one question.

Then create one filter.

For example:

Who is this computer talking to?
ip.addr == 192.168.1.10

Then:

What is it doing with DNS?
ip.addr == 192.168.1.10 && dns

Then:

Which HTTPS connections are involved?
ip.addr == 192.168.1.10 && tcp.port == 443

That's how you learn Wireshark.

One packet. One filter. One question at a time.

🔜 Continue the Wireshark Series

Part 1 — Wireshark: The Complete Beginner's Guide to Network Traffic Analysis

👉 https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/wireshark-the-complete-beginners-guide-to-network-traffic-analysis-44771b1bf542

Part 2 — Wireshark: Understanding Packets, Protocols & Network Layers

Part 3 — Wireshark Display Filters: Finding What Matters in Thousands of Packets

Coming next:

Part 4 — Wireshark: Follow TCP Stream & Reconstructing Network Conversations

Official Wireshark Resources

Use Wireshark only on networks and traffic you own or have explicit authorization to monitor or analyze.