Display Filters

Display filters control which packets are shown in the Wireshark GUI after capture. Unlike capture filters, they are incredibly flexible — you can filter by protocol fields, byte values, string matches, and even expressions.

Key Difference

Display filters operate on already-captured data. They do not affect what is recorded. Use the filter bar at the top of the packet list pane.

Filter Syntax

A display filter expression consists of one or more primitives combined with logical operators.

Syntax
1[protocol].[field] [operator] [value]

Comparison Operators

OperatorMeaning
==Equal
!=Not equal
>Greater than
<Less than
>=Greater than or equal
<=Less than or equal

Logical Operators

andBoth conditions must be true
wireshark
ip.src == 192.168.1.1 and tcp.port == 80
orEither condition can be true
wireshark
tcp.port == 80 or tcp.port == 443
notNegate the condition
wireshark
not arp
inCheck if value is in a set
wireshark
tcp.port in {80 443 8080}

Common Display Filters

wireshark
ip.addr == 192.168.1.1

Any packet involving IP 192.168.1.1

wireshark
ip.src == 10.0.0.0/8

Source is in 10.0.0.0/8 subnet

wireshark
tcp.port == 443

TCP traffic on port 443 (HTTPS)

wireshark
udp.port == 53

UDP traffic on port 53 (DNS)

wireshark
dns

All DNS traffic

wireshark
http.request.method == "GET"

HTTP GET requests

wireshark
ssl.handshake.type == 1

SSL/TLS Client Hello

wireshark
frame.len > 1000

Frames larger than 1000 bytes

wireshark
tcp.analysis.retransmission

TCP retransmissions

wireshark
icmp.type == 8

ICMP Echo Request (ping)

wireshark
arp

All ARP packets

wireshark
ipv6

All IPv6 traffic

String Matching

You can match strings in packet payloads using contains, matches, or ~ (regex).

String Matching
1# Find HTTP requests containing "password"
2http.request.method == "POST" and http contains "password"
3 
4# Match a regex in the payload
5tcp.payload matches "(?i)login"
6 
7# DNS query containing a domain
8dns.qry.name contains "google"
9 
10# Search any frame data for a string
11frame contains "GET /admin"

Protocol Field Reference

Wireshark exposes thousands of protocol fields. Use View > Internals > Supported Protocols or right-click any field in the packet details pane and select Prepare as Filter.

ProtocolUseful Fields
ipip.src, ip.dst, ip.addr, ip.proto, ip.len, ip.ttl
tcptcp.srcport, tcp.dstport, tcp.port, tcp.flags, tcp.seq, tcp.ack
udpudp.srcport, udp.dstport, udp.port, udp.length
httphttp.request, http.response, http.host, http.uri, http.method
dnsdns.qry.name, dns.qry.type, dns.resp.name, dns.flags.response
ssl / tlsssl.handshake.type, tls.handshake.extensions_sni, ssl.record.content_type
icmpicmp.type, icmp.code, icmp.data_time
frameframe.number, frame.time, frame.len, frame.protocols

Auto-Complete

Wireshark has excellent auto-complete for display filters. Start typing a protocol name and press Tab to see available fields.

Coloring Rules with Filters

You can colorize packets in the list using display filters via View > Coloring Rules. For example:

Coloring
1# Color HTTP errors red
2http.response.code >= 400
3 
4# Color DNS queries cyan
5dns.flags.response == 0
6 
7# Color TCP retransmissions orange
8tcp.analysis.retransmission
Next: Filter Builder Back