Top 20 Wireshark Filters Every Network Engineer Must Know

—
Wireshark is one of the most useful tools for network troubleshooting.
But a packet capture can quickly contain thousands or even millions of packets.
Without filters, finding the packets related to your problem can become difficult.
Wireshark display filters solve this problem.
They allow you to focus on traffic such as:

• One IP address

• One server

• One subnet

• TCP or UDP

• DNS

• HTTP

• TLS

• TCP handshakes

• Retransmissions

• ICMP

• SIP

• RTP

• Malformed packets

For example, suppose a user reports:
“The application is very slow.”
A full packet capture may contain DNS, HTTPS, background applications, operating-system traffic, monitoring traffic, and many unrelated connections.
Instead of reviewing everything, you can apply a filter such as:

ip.addr == 192.168.1.10

Now Wireshark displays packets involving only that IP address.
You can then refine the filter further.
For example:

ip.addr == 192.168.1.10 && tcp.port == 443

This shows TCP port 443 traffic involving that host.
This guide covers 20 practical Wireshark display filters that network engineers can use during everyday troubleshooting.

—

Understanding Wireshark Display Filters

Before learning individual filters, understand a few basic rules.

Display Filter vs Capture Filter

A display filter changes what Wireshark shows from packets that have already been captured.
Example:

tcp.port == 443

A capture filter decides which packets are recorded in the first place.
Example capture filter:

tcp port 443

Notice the difference.
Display filter:

tcp.port == 443

Capture filter:

tcp port 443

Combining Filters

Use && for AND.
Example:

ip.addr == 192.168.1.10 && tcp.port == 443

This means:
Show packets involving 192.168.1.10 AND TCP port 443.
Use || for OR.
Example:

tcp.port == 80 || tcp.port == 443

This means:
Show packets using TCP port 80 OR TCP port 443.
Use ! for NOT.
Example:

tcp && !tcp.port == 22

This is useful when excluding traffic from the view.

A Better Modern Port Filter

Wireshark also supports set membership.
For example:

tcp.port in {80, 443, 8080}

This is cleaner than writing:

tcp.port == 80 || tcp.port == 443 || tcp.port == 8080

Start Broad, Then Narrow

A good troubleshooting workflow is:

—

Top 20 Wireshark Display Filters

1. Filter Traffic for One IP Address

Use:

ip.addr == 192.168.1.10

This matches IPv4 packets where the address appears as either the source or destination.

Practical Example

Suppose:

Apply:

ip.addr == 192.168.1.10

Now you can focus on traffic involving that server.

Useful For

• Server troubleshooting

• Firewall troubleshooting

• Client connectivity problems

• Application analysis

—

2. Filter by Source or Destination IP

Source IP:

ip.src == 192.168.1.10

Destination IP:

ip.dst == 192.168.1.10

Practical Example

Suppose you want to know whether a firewall is forwarding traffic toward:
192.168.1.50
Use:

ip.dst == 192.168.1.50

To inspect packets originating from that server:

ip.src == 192.168.1.50

—

3. Filter a Subnet

Example:

ip.addr == 192.168.1.0/24

This can help display IPv4 traffic involving addresses in that subnet.

Practical Example

Suppose IoT devices are located in:
192.168.50.0/24
Use:

ip.addr == 192.168.50.0/24

This makes it easier to review traffic involving the IoT network.

Useful For

• VLAN troubleshooting

• IoT analysis

• User-segment analysis

• Network migrations

—

4. Filter by TCP or UDP Port

TCP 443:

tcp.port == 443

UDP 53:

udp.port == 53

Multiple TCP ports:

tcp.port in {80, 443, 8080}

Practical Example

To inspect HTTPS traffic involving one server:

ip.addr == 192.168.1.10 && tcp.port == 443

—

5. Show Only TCP Traffic

Use:

tcp

This shows packets Wireshark has decoded as TCP.

Useful For

• TCP handshake troubleshooting

• Retransmission analysis

• Window problems

• Reset analysis

• Application connections

Combine with one host:

tcp && ip.addr == 192.168.1.10

—

6. Show Only UDP Traffic

Use:

udp

Useful For

• DNS

• RTP

• QUIC

• SNMP

• Syslog

• Some VPN protocols

Example:

udp && ip.addr == 192.168.1.25

—

7. Show HTTP Requests

Use:

http.request

This displays HTTP requests decoded by Wireshark.

Practical Example

Suppose a browser repeatedly requests the same resource.
Use:

http.request

Then inspect:

• Request method

• Host

• URI

• User agent

—

8. Filter HTTP GET or POST Requests

GET:

http.request.method == "GET"

POST:

http.request.method == "POST"

GET or POST:

http.request.method in {"GET", "POST"}

Practical Example

Suppose an API submission is failing.
Filter:

http.request.method == "POST"

Then inspect whether the expected request reached the server.
—

9. Filter DNS Queries for a Domain

Use:

dns.qry.name == "sanchitgurukul.com"

This is useful when troubleshooting hostname resolution.

Practical Example

Suppose users cannot open:
sanchitgurukul.com
Apply:

dns.qry.name == "sanchitgurukul.com"

Look for:

• Query sent

• Resolver address

• Response

• RCODE

• Answer

• Response time

—

10. Show Failed DNS Responses

Show DNS responses where the response code is non-zero:

dns.flags.rcode != 0

NXDOMAIN:

dns.flags.rcode == 3

SERVFAIL:

dns.flags.rcode == 2

REFUSED:

dns.flags.rcode == 5

Practical Example

If a SaaS application fails because DNS resolution is failing:

dns.flags.rcode == 2

shows SERVFAIL responses.

—

11. Show TLS Handshake Traffic

Use:

tls.handshake

ClientHello:

tls.handshake.type == 1

ServerHello:

tls.handshake.type == 2

Practical Example

Suppose HTTPS establishes TCP but TLS does not complete.
Filter:

tls.handshake

Then determine how far the TLS handshake progresses.

Useful For

• TLS version analysis

• ClientHello review

• ServerHello review

• ALPN troubleshooting

• HTTPS troubleshooting

—

12. Show TLS Alerts

Use:

tls.alert_message

You can also inspect the alert description field when available.

Practical Example

Suppose:

Apply:

tls.alert_message

If an alert exists, inspect its context.

—

13. Show TCP SYN Connection Attempts

Initial client SYN:

tcp.flags.syn == 1 && tcp.flags.ack == 0

All packets where SYN is set:

tcp.flags.syn == 1

Practical Example

A user says:
“The server does not respond.”
Use:

tcp.flags.syn == 1 && tcp.flags.ack == 0

Then inspect whether:

• SYN leaves the client

• SYN repeats

• SYN-ACK returns

—

14. Show TCP Retransmissions

Use:

tcp.analysis.retransmission

Fast retransmissions:

tcp.analysis.fast_retransmission

Spurious retransmissions:

tcp.analysis.spurious_retransmission

Practical Example

An application transfer appears slow.
Apply:

tcp.analysis.retransmission

Then inspect:

• Which direction retransmits

• Frequency

• Timing

• Duplicate ACK behavior

• Whether the capture point missed packets

• Whether retransmissions correlate with application slowdown

—

15. Find Large Frames

Example:

frame.len > 1514

You can change the value to match your network environment.
For example:

frame.len > 9000

may help identify very large frames in an environment where such sizes are unexpected.

Practical Example

Suppose you are troubleshooting a possible MTU or jumbo-frame problem.
Use:

frame.len > 1514

as one investigative filter.

—

16. Show ICMP Echo Requests and Replies

ICMP Echo Request:

icmp.type == 8

ICMP Echo Reply:

icmp.type == 0

Both:

icmp.type == 8 || icmp.type == 0

Practical Example

You run:

ping 192.168.1.10

Use:

icmp.type == 8 || icmp.type == 0

to verify requests and replies.

—

17. Show SIP Signaling

Use:

sip

Useful For

• SIP registration

• Call setup

• INVITE analysis

• Authentication failures

• BYE messages

• SIP response codes

Practical Example

Suppose a VoIP endpoint cannot register.
Apply:

sip

Look for messages such as:

REGISTER

401 Unauthorized

REGISTER

200 OK

The exact sequence depends on the SIP implementation and authentication process.
—

18. Show RTP Traffic

Use:

rtp

RTP commonly carries real-time audio or video.

Practical Example

A VoIP call connects but audio quality is poor.
Apply:

rtp

Then use Wireshark’s RTP analysis features to investigate:

• Sequence numbers

• Packet loss

• Timing

• Jitter-related behavior

• Stream direction

—

19. Show Malformed Packets

Use:

_ws.malformed

This shows packets Wireshark has marked as malformed.

Practical Example

Suppose a protocol parser reports unexpected data.
Apply:

_ws.malformed

Then inspect the packet and surrounding traffic.

—

20. Use Regex Matching

Wireshark supports the matches operator for regular-expression matching on suitable fields.
Example:

http.host matches "google.(com|co.uk)"

A simpler hostname example:

http.host matches ".*google.*"

Practical Example

Suppose you want to find visible HTTP Host values containing:
google
Use:

http.host matches ".*google.*"

Another useful example:

dns.qry.name matches ".*.example.com"

This can help find DNS queries for names ending in example.com.

—

Practical Troubleshooting Examples

The real value of Wireshark filters appears when several filters are combined to investigate a problem.

Scenario 1 — Website Is Slow

Suppose:

Start with:

ip.addr == 192.168.1.25 && ip.addr == 203.0.113.10

Then focus on TCP:

ip.addr == 192.168.1.25 && ip.addr == 203.0.113.10 && tcp

Check retransmissions:

ip.addr == 192.168.1.25 && ip.addr == 203.0.113.10 && tcp.analysis.retransmission

Check resets:

ip.addr == 192.168.1.25 && ip.addr == 203.0.113.10 && tcp.flags.reset == 1

—

Scenario 2 — DNS Resolution Fails

Start with:

dns

Find errors:

dns.flags.rcode != 0

Check NXDOMAIN:

dns.flags.rcode == 3

Check SERVFAIL:

dns.flags.rcode == 2

Check one domain:

dns.qry.name == "sanchitgurukul.com"

—

Scenario 3 — TCP Connection Cannot Establish

Find initial SYN packets:

tcp.flags.syn == 1 && tcp.flags.ack == 0

Suppose you see:

SYN

SYN Retransmission

SYN Retransmission

No SYN-ACK is visible at the client.
Possible areas include:

• Routing

• Firewall

• NAT

• Security group

• Server listener

• Return path

—

Scenario 4 — TLS Connection Fails

Start with:

tls.handshake

Look for alerts:

tls.alert_message

Check ClientHello:

tls.handshake.type == 1

Check ServerHello:

tls.handshake.type == 2

—

Scenario 5 — VoIP Call Has Poor Audio

Start with SIP:

sip

Verify call establishment.
Then inspect media:

rtp

Use:
Telephony → RTP → RTP Streams
Analyze the relevant stream.
Check:

• Missing sequence numbers

• Packet timing

• Stream direction

• Jitter

• Loss indications

—

Scenario 6 — Security Investigation

Suppose you are investigating POST requests to a specific destination in an authorized environment.
Use:

http.request.method == "POST" && ip.dst == 203.0.113.5

This shows visible HTTP POST requests directed toward the destination.

—

Advanced Filter Combinations and Best Practices

Once you understand the basic filters, combining them makes Wireshark significantly more useful.

One Client to One Server

ip.addr == 192.168.1.25 && ip.addr == 203.0.113.10

One Client to HTTPS

ip.addr == 192.168.1.25 && tcp.port == 443

TCP Problems for One Host

ip.addr == 192.168.1.25 && tcp.analysis.flags

This can help find TCP analysis annotations generated by Wireshark.

SYN or Reset Packets

tcp.flags.syn == 1 || tcp.flags.reset == 1

DNS Errors From One Client

ip.addr == 192.168.1.25 && dns.flags.rcode != 0

HTTP GET or POST

http.request.method in {"GET", "POST"}

Web Service Ports

tcp.port in {80, 443, 8080, 8443}

One TCP Stream

Wireshark assigns TCP connections a stream number.
Example:

tcp.stream == 7

This is one of the most useful filters during detailed TCP analysis.
Select a packet from the connection and determine its TCP stream number.
Then filter the entire conversation.

Save Frequently Used Filters

Wireshark allows display filters to be saved for future use.
Useful saved filters might include:

Use Coloring Rules

Display filters can also support coloring rules.
For example, you may highlight:

• Resets

• Retransmissions

• DNS errors

• TLS alerts

This makes unusual packets easier to locate visually.

Do Not Trust One Filter Alone

A filter helps locate evidence.
It does not provide the entire diagnosis.
For example:

Use Multiple Capture Points

For difficult problems, capture at:

• Client

• Firewall ingress

• Firewall egress

• Load balancer

• Server

Then compare the same traffic.

Recommended Troubleshooting Workflow

—

Quick Wireshark Filter Reference

One IP

ip.addr == 192.168.1.10

Source IP

ip.src == 192.168.1.10

Destination IP

ip.dst == 192.168.1.10

Subnet

ip.addr == 192.168.1.0/24

TCP Port

tcp.port == 443

TCP

tcp

UDP

udp

HTTP Requests

http.request

HTTP POST

http.request.method == "POST"

DNS Query

dns.qry.name == "sanchitgurukul.com"

DNS Errors

dns.flags.rcode != 0

TLS Handshake

tls.handshake

TLS Alerts

tls.alert_message

Initial TCP SYN

tcp.flags.syn == 1 && tcp.flags.ack == 0

TCP Retransmissions

tcp.analysis.retransmission

Large Frames

frame.len > 1514

Ping

icmp.type == 8 || icmp.type == 0

SIP

sip

RTP

rtp

Malformed Packets

_ws.malformed

Regex Example

dns.qry.name matches ".*.example.com"

—

Summary

Wireshark display filters turn a large packet capture into a manageable troubleshooting view.
The most useful approach is not to memorize hundreds of filters.
Instead, understand how to build them.
Start with the affected endpoint:

ip.addr == 192.168.1.10

Then add a protocol:

ip.addr == 192.168.1.10 && tcp

Then add a service:

ip.addr == 192.168.1.10 && tcp.port == 443

Then investigate behavior such as retransmissions:

ip.addr == 192.168.1.10 && tcp.port == 443 && tcp.analysis.retransmission

The 20 filters covered in this guide help analyze:

• Hosts

• Networks

• TCP

• UDP

• HTTP

• DNS

• TLS

• TCP handshakes

• Retransmissions

• Packet sizes

• ICMP

• SIP

• RTP

• Malformed packets

• Pattern matching

The important rule is:
A filter identifies packets of interest.
It does not automatically identify the root cause.
Use packet sequence, timing, multiple capture points, device logs, and application behavior together before reaching a conclusion.

—

Useful Links and References

SanchitGurukul Static Resources

Related SanchitGurukul Articles

Official External References