Wireshark Display Filter Builder and Cheat Sheet
Wireshark is a free network protocol analyser, and its display filters are how you cut a capture down to the packets that matter. Pick fields and operators below to build a filter, then copy it into Wireshark. This page is educational: it does not capture traffic, and it does not download or replace Wireshark itself (get that from wireshark.org).
TL;DRThe short version
5 points
- A Wireshark display filter chooses which already-captured packets are shown. The packets stay in the capture file; the filter only hides the rest.
- Filters are made of protocol or field names (ip.addr, tcp.port, http.request.method), comparison operators (==, !=, >, <, contains, matches, in) and logical operators (and, or, not).
- Display filters are not capture filters. Capture filters use the libpcap (pcap-filter) syntax and decide what is recorded in the first place.
- The builder below assembles a filter from field names listed in the Wireshark Display Filter Reference. It does not capture, read or upload any traffic.
- Only capture on networks you own or have permission to monitor. In the US, intercepting communications without authorization can violate 18 U.S.C. 2511 (general information, not legal advice).
Build a display filter
Add conditions, join them with and / or, and copy the result into Wireshark's display filter bar. The filter is only text. Nothing is captured or sent anywhere.
IPv4 source or destination address
Your filter
- Row 1: Enter a value.
The filter is assembled from operators and field names checked against the Wireshark documentation. Wireshark colours the filter bar green (valid), red (invalid) or yellow (warning) as you type, so paste it there to confirm.
Display filter cheat sheet
Click Copy to take any filter to Wireshark. The tag shows where each one comes from: User's Guide, Wiki, or Field reference (composed from field names in the Display Filter Reference).
Everyday
tcpShow TCP packets. [User's Guide]http.requestShow HTTP requests. [User's Guide]ip.addr == 192.168.0.1Packets to or from this address. [User's Guide]ip.addr == 129.111.0.0/16Packets to or from an IPv4 subnet. [User's Guide]!(ip.addr == 10.43.54.65)Exclude all traffic to or from one address. The wiki warns that ip.addr != x is the wrong way to do this on older versions. [Wiki]tcp.port in {80, 443, 8080}Any of several ports, in either direction. [User's Guide]tcp.port == 80 and ip.src == 192.168.2.1Combine conditions with and, or, not (or &&, ||, !). [User's Guide]tcp.port eq 25 or icmpShow SMTP (port 25) and ICMP traffic. [Wiki]
TCP
tcp.flags.syn == 1Packets with the SYN flag set. [User's Guide]tcp.flags.syn == 1 and tcp.flags.ack == 0Connection attempts: SYN set, ACK not set. Composed from reference fields. [Field reference]tcp.analysis.retransmissionPackets Wireshark marks as suspected retransmissions. [Field reference]tcp.window_size == 0 && tcp.flags.reset != 1Zero window: the receiver buffer is full and the sender is told to stop. [Wiki]tcp.flags & 0x02The SYN bit tested with a bitwise AND. [User's Guide]max(tcp.srcport, tcp.dstport) <= 1024Both ports at or below 1024. [User's Guide]tcp.stream == 0Follow one conversation by its stream index. Composed from reference fields. [Field reference]
HTTP
http.request.method == "POST"HTTP POST requests. [User's Guide]http.response.code >= 400HTTP error responses. Composed from reference fields. [Field reference]http.host matches "acme\\.(org|com|net)"Host header matches acme.org, .com or .net (regular expression). [User's Guide]http.request.uri matches "gl=se$"Request URIs ending in gl=se. [Wiki]len(http.request.uri) > 100Long request URIs, measured in bytes. [User's Guide]lower(http.server) contains "apache"Case-insensitive match on the Server header. [User's Guide]
DNS, TLS and ICMP
dnsShow DNS traffic. [Wiki]dns.qry.name contains "example"DNS queries whose name contains a string. Composed from reference fields. [Field reference]dns.flags.rcode == 3DNS replies with code 3 (Name Error, NXDOMAIN, per RFC 1035). [Field reference]tls.handshake.type == 1TLS Client Hello messages (type 1 in RFC 8446). [Field reference]tls.handshake.extensions_server_name contains "example"TLS handshakes naming a server in the SNI extension. [Field reference]icmp.type == 8ICMP echo requests (type 8, as used by ping). [Field reference]
Bytes and layers
udp contains 81:60:03A 3-byte sequence anywhere in the UDP header or payload. [User's Guide]eth.addr[0:3]==00:06:5BTraffic from one vendor using the first three bytes (OUI) of the MAC address. [Wiki]frame.len > 10Comparison on a frame property. [User's Guide]ip.src#1 == 10.1.2.3Layer operator: outer IPv4 source in tunnelled packets (Wireshark 4.0 and later). [Wiki]
Operators
| C-like | English | Meaning |
|---|---|---|
| == | eq | equal |
| != | ne | not equal |
| > | gt | greater than |
| < | lt | less than |
| >= | ge | greater than or equal |
| <= | le | less than or equal |
| contains | contains | field contains the value |
| ~ (matches) | matches (~) | field matches a regular expression |
| in | in | field is one of a set, e.g. {80, 443, 8000..8100} |
Logical operators: and / &&, or / ||, xor / ^^, not / !. A byte-level slice such as eth.src[0:3] == 00:00:83 tests part of a field. Wireshark 3.6 changed != to mean “all values differ”, so use !(field == value) if you need the same behaviour on every version.
Display filter or capture filter?
Capture filter
Applied while recording. Uses libpcap (pcap-filter) syntax. Example from the User's Guide: tcp port 23 and host 10.0.0.5.
Display filter
Applied to what is already captured. Uses Wireshark field names. All packets remain in the file. The equivalent: tcp.port == 23 and ip.addr == 10.0.0.5.
Use it responsibly
Capturing traffic can expose other people's data. Capture only on your own network or with written permission, keep captures protected, and follow your organisation's policy. For what a network defender does next with what the capture shows, see the OSI Model Attack Map, the Port Risk Lookup and the Log Triage lab.
Sources
- Wireshark Foundation, User's Guide: Building display filter expressions (operators, membership, slices, functions), accessed 3 November 2026.
- Wireshark, wireshark-filter(4) man page, accessed 3 November 2026.
- Wireshark Wiki, DisplayFilters (examples and the ip.addr exclusion gotcha), accessed 3 November 2026.
- Wireshark, Display Filter Reference pages for ip, tcp, http, dns, tls, icmp, arp and frame (field names; the reference lists versions up to 4.6.9), accessed 3 November 2026.
- Wireshark, User's Guide: Capture filters and Filtering packets while viewing, accessed 3 November 2026.
- IETF RFC 1035 (DNS RCODE 3 Name Error) and RFC 8446 (TLS ClientHello type 1).
- 18 U.S.C. 2511, Interception and disclosure of wire, oral, or electronic communications prohibited.
Last reviewed 3 November 2026. Wireshark is a third-party project; PlayCISO is not affiliated with it. Field availability can differ by version, so confirm in your own copy: Wireshark colours the filter bar to show whether a filter is valid.
Frequently asked questions
What is a Wireshark display filter?
A display filter controls which packets of an open capture are shown. The Wireshark User's Guide says that when you use one, all packets remain in the capture file; the filter only hides the uninteresting ones. You type it into the display filter toolbar and press Enter.
What is the difference between a display filter and a capture filter?
A capture filter limits which packets are recorded while capturing and uses the libpcap filter language, for example "tcp port 23 and host 10.0.0.5". A display filter works on packets already captured and uses Wireshark's own field-based syntax, for example "tcp.port == 23 and ip.addr == 10.0.0.5". The two syntaxes are not interchangeable.
How do I filter by IP address in Wireshark?
Use ip.addr == 192.168.0.1 to see packets to or from an address, ip.src for the source only and ip.dst for the destination only. A subnet works too: ip.addr == 129.111.0.0/16. To exclude an address, the Wireshark wiki recommends !(ip.addr == 10.43.54.65) rather than ip.addr != 10.43.54.65.
How do I filter by port?
tcp.port == 443 matches either direction; tcp.srcport and tcp.dstport match one side. Several ports at once use the membership operator: tcp.port in {80, 443, 8080}.
How do I show only HTTP requests, or only POST requests?
http.request shows HTTP requests, and http.request.method == "POST" narrows them to POST. Text values go in double quotes.
What do contains and matches do?
contains tests whether a field or byte sequence includes a value, for example sip.To contains "a1762". matches tests a text field against a Perl-compatible regular expression, for example http.host matches "acme\\.(org|com|net)". In the current User's Guide, raw strings such as r"\(X11;" are shown as a way to avoid escaping problems.
Can I use && and || instead of and / or?
Yes. The User's Guide lists both forms: and / &&, or / ||, xor / ^^ and not / !, and says English and C-like operators can be mixed.
Why does ip.addr != x not exclude an address?
ip.addr can match two values in one packet (source and destination). Wireshark 3.6 changed != to mean that all values must differ, where it previously meant any value differs, so results depend on your version. Negating an equality, !(ip.addr == x), behaves the same everywhere, and the builder does that for you.
Is it legal to use Wireshark?
The software is legal to use. Capturing other people's traffic is the issue: in the US, 18 U.S.C. 2511 prohibits intentionally intercepting wire, oral or electronic communications unless an exception applies. Capture only on networks and devices you own or are explicitly authorised to monitor, and follow your employer's policy. This is general information, not legal advice.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.