One of the coolest design touches about Wireshark is that if you enter a filter expression that is syntactically invalid, the background of the filter field turns red. You can construct a filter expression here and when you close the dialog box, it will appear in the filter field (although you still have to press Enter). This brings up a dialog box showing and all possible field names and operators. So how do you learn the syntax for Wireshark filter expressions? Click the Expression. To clear the filter, click the Clear button to the right of the filter field, and all your packets will reappear in the packet list. There are 935 supported protocols, so you should be able to choose the one you want! If you want inbound packets only, use ip.dst.) If you want to see only packets for a specific protocol, it’s even easier: just type in the protocol name (ARP, DNS, HTTP, etc.) in the filter field. (If you want to only see outbound packets from this address, use ip.src instead of ip.addr. If you want to see only packets coming into or going out of 10.10.1.20, simply enter ip.addr = 10.10.1.20 in this filter field and hit Enter. There’s a “filter” field just below the button bar in which you can type a filter expression that will limit the display.

Now while it can be useful to have an overview of everything, usually when troubleshooting a problem or trying to understand a network “conversation,” you’ll want at some point to restrict the packet list based on certain criteria.įor example, you may only be interested in traffic to or from a given host. If you chose to perform a “promiscuous mode” capture then you could see packets from multiple sources. Unless you specify a filter when you create the capture file in Wireshark, you’ll see all the captured packets in the packet list pane.

Wireshark filters for protocol