WireShark.Com is not affiliated with Ethereal Wireshark

Wireshark Filters Explained: Display and Capture Filters

Wireshark filters allow you to focus on the packets that actually matter. Instead of scrolling through thousands of packets, filters help isolate specific IP addresses, protocols, ports, or conversations so you can troubleshoot faster and understand what is really happening on the network.

Explore Common Filters / Display Filters Guide

Display Filters Explained

Learn how Wireshark display filters work and how they help isolate specific packets after a capture is complete.

How to Use Wireshark Filters

Understand how filters are applied while analyzing captures and how they help simplify complex packet traces.

Capture Filters

Capture filters limit which packets Wireshark records during capture, helping reduce noise and large capture files.

What Are Wireshark Filters?

When you capture network traffic in Wireshark, the amount of data can be overwhelming. Even a short capture may contain thousands of packets from many different devices, protocols, and applications. Wireshark filters allow you to narrow that data down so you can focus only on the packets you care about.

Instead of manually scanning through large packet lists, filters let you isolate traffic by IP address, protocol, port, or specific packet behavior. For example, you might want to view only DNS traffic, analyze HTTP requests, or check for TCP retransmissions that could indicate network problems.

Wireshark supports two types of filters: capture filters and display filters. Capture filters control which packets are recorded during the capture process, while display filters allow you to refine the packets shown after the capture is complete.

Common Wireshark Filter Examples

One of the fastest ways to analyze network traffic is by using simple filters that isolate specific protocols, IP addresses, or packet behaviors. Below are some of the most commonly used Wireshark filters that network engineers and security analysts rely on during packet analysis.

DNS Traffic – dns
HTTP Traffic – http
HTTPS Traffic – tcp.port == 443
Specific IP Address – ip.addr == 192.168.1.1
TCP Retransmissions – tcp.analysis.retransmission
ICMP (Ping) Traffic – icmp

These filters can be entered directly into the Wireshark display filter bar after capturing traffic. Once applied, Wireshark instantly updates the packet list so you can focus only on relevant packets.

Display Filters vs Capture Filters

Wireshark actually supports two different types of filters, and understanding the difference between them is important when analyzing network traffic. These are called capture filters and display filters. While they both help reduce the amount of traffic you see, they work at different stages of the packet capture process.

Capture filters are applied before the capture begins. They tell Wireshark which packets should be recorded in the first place. This can be useful when capturing traffic on busy networks, because it prevents Wireshark from saving large amounts of unnecessary data. For example, you might capture only DNS traffic or only packets from a specific host.

Display filters, on the other hand, are applied after the packets have already been captured. Instead of controlling what gets recorded, they control what is shown in the packet list. This makes it easy to hide unrelated traffic and focus on the packets you want to analyze.

In practice, most users rely heavily on display filters because they allow quick exploration of captured traffic. However, capture filters are extremely helpful when working with high-volume networks or when you already know exactly what traffic you want to capture.

For a deeper explanation and practical examples, you can review our full Wireshark Display Filters Guide.

Capture filters limit which packets are recorded, while display filters refine which packets appear in the analysis view.

When Filters Are Useful

Applying a filter in Wireshark is straightforward once you know where the filter bar is located. At the top of the Wireshark interface you will see the display filter field, which allows you to type a filter expression to narrow the packets shown in the packet list.

To apply a filter, simply enter the filter expression into the filter bar and press Enter. Wireshark will immediately update the packet list to show only the packets that match the filter criteria.

As you begin typing a filter, Wireshark also provides helpful autocomplete suggestions. These suggestions make it easier to find the correct protocol fields and reduce syntax mistakes when building more complex filters.

If a filter is written correctly, the filter bar will turn green. If the filter contains an error, the bar will appear red, indicating that the syntax needs to be corrected before it can be applied.

Many analysts start with simple filters such as filtering by protocol or IP address, and then gradually refine the filter to isolate specific packets or conversations during troubleshooting.

Tips for Using Filters

When working with packet captures, filters become much more powerful when you apply them strategically. Instead of relying on a single filter, many analysts refine their filters step by step as they narrow down the traffic they want to investigate.

One helpful approach is to begin with a broad filter and then gradually make it more specific. For example, you might first filter for a protocol such as DNS or HTTP, and then add additional conditions such as an IP address or port number to isolate the exact conversation you want to analyze.

Wireshark also provides autocomplete suggestions as you type in the filter bar. These suggestions help identify valid protocol fields and can save time when constructing more advanced filters. If you are unsure about the correct syntax, the suggestions often guide you toward the correct field names.

Another useful technique is combining filters using logical operators such as and, or, and not. This allows you to build more precise filters that focus only on the traffic relevant to your investigation.

Finally, remember that filters are meant to simplify analysis. If a filter becomes too complex, it can sometimes hide important packets. Many analysts apply filters incrementally and periodically clear them to review the full packet capture again.

Learn Wireshark FAQS

What is a Wireshark filter?

A Wireshark filter allows you to narrow down captured network traffic so you can focus on specific packets. Filters can isolate traffic by IP address, protocol, port number, or packet behavior, making it much easier to analyze large packet captures.

What is the difference between capture filters and display filters?

Capture filters determine which packets Wireshark records during the capture process, while display filters are used after the capture is complete to refine which packets are shown in the packet list. Display filters are the most commonly used when analyzing traffic.

How do you filter traffic by IP address in Wireshark?

To filter traffic from a specific IP address, you can use a display filter such as ip.addr == 192.168.1.1. This will show packets where the specified IP appears as either the source or destination address.

Can Wireshark filter traffic by port?

Yes. Wireshark can filter packets by port number. For example, to view HTTPS traffic you can use the display filter tcp.port == 443. This shows packets where TCP port 443 is used.

Why are Wireshark filters important during packet analysis?

Filters help reduce noise in packet captures and make it easier to focus on relevant traffic. Without filters, large captures may contain thousands of packets that are unrelated to the issue being investigated.

Do beginners need to learn filters to use Wireshark?

Yes. Filters are one of the most important skills when learning Wireshark. Even simple filters such as filtering by protocol, IP address, or port can dramatically simplify packet analysis and make troubleshooting much faster.

Related Wireshark Guides

Explore these additional guides to improve your packet capture and network analysis skills with Wireshark.

Wireshark Display Filters Guide	Learn how to isolate packets using protocol fields, IP addresses, and advanced filter expressions.
How to Use Wireshark	A beginner-friendly walkthrough explaining how to capture and analyze packets step by step.
How to Capture Packets in Wireshark	Learn how to start packet captures, choose the correct interface, and analyze live traffic.
Wireshark vs tcpdump	Understand when to use Wireshark’s graphical interface or the tcpdump command-line tool.

WireShark.Com

is not affiliated with Ethereal Wireshark

We provide independent educational content about packet sniffers, network traffic analysis, and troubleshooting techniques. Our goal is to help learners and professionals understand packet behavior and diagnose real-world network issues.