NetOps Toolkit

Security

Wireshark Filter Builder

Build Wireshark display filters — protocols, IPs, ports, TCP flags, compound expressions, and quick-copy library

What is a Wireshark Display Filter?

A display filter narrows which packets appear in the packet list without discarding captured data. Unlike capture filters (BPF syntax written before capture), display filters use Wireshark's own field-based syntax and can reference any decoded protocol field.

Display filter ≠ Capture filter. Capture filters use BPF syntax (e.g., tcp port 80). Display filters use Wireshark field notation (e.g., tcp.port == 80). They are not interchangeable.

Comparison Operators

EnglishSymbolExampleMeaning
eq==ip.ttl == 64Equal to
ne!=eth.type != 0x0800Not equal — see Gotchas!
gt>frame.len > 1000Greater than
lt<tcp.window_size < 1024Less than
ge>=udp.length >= 512Greater than or equal
le<=ip.ttl <= 10Less than or equal
containshttp contains "login"Field or protocol contains value
matches~http.host matches ".gov$"PCRE regular expression

Logical Operators

EnglishSymbolExample
and&&ip.src == 10.0.0.1 && tcp.port == 443
or||tcp.port == 80 || tcp.port == 443
not!!icmp
Use parentheses to group: (ip.src == 10.0.0.1 || ip.src == 10.0.0.2) && tcp.port == 80

Gotchas — Read These!

  • ip.addr != 10.1.1.1 does NOT exclude that IP. It matches any packet where at least one address field is not that value. Use !(ip.addr == 10.1.1.1) instead. Same trap applies to tcp.port, udp.port, and eth.addr.
  • Tunneled protocols (GRE, VXLAN) have two IP layers. Use ip.src#1 for outer, ip.src#2 for inner (Wireshark 4.0+).
  • String comparisons are case-sensitive: http.request.method == "GET" works; "get" does not.

Protocol Field Reference

FieldScopeExample
ip.addrIPv4 src or dstip.addr == 192.168.1.10
ip.src / ip.dstIPv4 directionalip.src == 10.0.0.0/8
ipv6.addrIPv6 src or dstipv6.addr == fe80::1
tcp.port / udp.portsrc or dst porttcp.port == 443
tcp.srcport / tcp.dstportDirectional porttcp.dstport == 80
tcp.flags.syn / .ack / .fin / .rstTCP flag bitstcp.flags.syn == 1
tcp.window_sizeReceive windowtcp.window_size == 0
eth.addr / eth.src / eth.dstMAC addresseth.src == aa:bb:cc:dd:ee:ff
eth.addr[0:3]OUI / vendor prefixeth.addr[0:3] == 00:06:5b
frame.lenTotal frame sizeframe.len > 1500
http.request.methodHTTP verbhttp.request.method == "POST"
http.request.uriHTTP URIhttp.request.uri matches "login"
dns.qry.nameDNS query namedns.qry.name contains "example"
sip.MethodSIP methodsip.Method == "INVITE"
vlan.id802.1Q VLAN IDvlan.id == 100
arp.opcodeARP op (1=req, 2=reply)arp.opcode == 1
icmp.typeICMP type numbericmp.type == 8
rtp.ssrcRTP stream SSRC IDrtp.ssrc == 0xdeadbeef
tls.handshake.typeTLS handshake typetls.handshake.type == 1
ip.src#1 / ip.src#2Layer-specific (v4.0+)ip.src#2 == 10.1.2.3