Wireshark Filters Cheat Sheet: 20 Display Filters Every Analyst Should Know

You open a packet capture. Two hundred thousand packets. Somewhere in there is the thing you're looking for.

Without filters, you're scrolling forever. With the right display filter, you find it in seconds. That's the whole game with Wireshark — and these 20 filters cover most of what you'll actually need. Bookmark it.

Quick Note: Display Filters vs Capture Filters

Two different things, and people mix them up constantly.

- Capture filters decide what Wireshark records. Set before you start. Different (BPF) syntax.

- Display filters decide what Wireshark shows you from what's already captured. This is where you live during analysis.

This cheat sheet is all display filters — the ones you type into that bar at the top while you're hunting.

The Basics: Filtering by IP

1. Traffic to or from a specific host:

ip.addr == 192.168.1.100

ip.addr matches either source or destination. This is your most-used filter, period.

2. Traffic FROM a specific source:

ip.src == 192.168.1.100

3. Traffic TO a specific destination:

ip.dst == 10.0.0.5

4. Conversation between two hosts:

ip.addr == 192.168.1.100 && ip.addr == 10.0.0.5

&& is AND. This isolates the traffic between exactly two machines — perfect for zooming in on one suspicious connection.

Filtering by Protocol

5. Just show one protocol:

http

Yep, that simple. Type the protocol name. Works for dns, tls, smb, arp, icmp, and dozens more.

6. DNS queries (great for spotting C2):

dns

Watch for weird domain lookups — malware has to resolve its command-and-control domain somehow.

7. Exclude the noise:

!(arp || dns)

! is NOT. This drops ARP and DNS chatter so you can see the interesting stuff. Build these exclusions up as noise annoys you.

Filtering by Port

8. Traffic on a specific port:

tcp.port == 443

9. Non-standard ports (suspicious!):

tcp.port != 80 && tcp.port != 443 && http

HTTP traffic on a weird port is worth a hard look — it's a classic evasion trick.

The Investigation Filters

Here's where it gets useful for actual SOC work.

10. Find SYN packets (connection attempts / scanning):

tcp.flags.syn == 1 && tcp.flags.ack == 0

A flood of these from one source hitting many ports? That's a port scan.

11. TCP resets (connection refused / blocked):

tcp.flags.reset == 1

12. HTTP requests only:

http.request

See exactly what URLs are being requested — great for spotting malicious downloads or callbacks.

13. Filter by HTTP method:

http.request.method == "POST"

POSTs are where data gets sent out — worth watching for exfiltration.

14. Search for a string in packet contents:

frame contains "password"

contains does a raw byte search across the packet. Powerful for finding cleartext credentials or specific indicators.

15. Filter by user agent (spot weird clients):

http.user_agent contains "curl"

Automated tools and malware often have telltale user agents that no normal browser would send.

The Encrypted-Traffic Filters

16. TLS client hello (see who's connecting where):

tls.handshake.type == 1

Even when traffic is encrypted, the handshake often reveals the destination server name — useful when you can't see the payload.

17. TLS server name (SNI):

tls.handshake.extensions_server_name contains "suspicious-domain"

The Cleanup Filters

18. Follow a single TCP stream:

Right-click a packet → Follow → TCP Stream. Wireshark auto-builds the filter:

tcp.stream == 4

This reconstructs an entire conversation in order — one of the most useful moves in the whole tool.

19. Filter out retransmissions (reduce noise):

!tcp.analysis.retransmission

20. Combine everything:

ip.dst == 10.0.0.5 && http.request.method == "POST" && frame contains "upload"

Filters stack with && and ||. Chaining them is how you go from 200,000 packets to the three that matter.

Reading Packets Like an Analyst

The filters are just the tool. The skill is knowing what to filter for.

A real investigation looks like: an alert says a host called out to a bad IP → you open the capture → filter ip.addr == → follow the TCP stream → see what was sent. Each filter narrows the question until you have the answer.

That's the same evidence-narrowing instinct you use reading logs or working any endpoint telemetry — different data source, identical thinking.

Quick Tips

1. Wireshark turns filters green when valid, red when broken. Watch the bar color as you type.

2. Right-click builds filters for you. Right-click any field → Apply as Filter. Faster than typing, and it teaches you the syntax.

3. Save filters you reuse. The bookmark icon by the filter bar stores your go-tos.

4. == vs contains vs matches. == is exact, contains is substring, matches is regex. Know which you need.

TL;DR – The Wireshark Filters That Matter

ip.addr, protocol names (http, dns, tls), and tcp.port cover most filtering. For investigations, lean on http.request, frame contains, TCP flag filters for scans, and "Follow TCP Stream" to reconstruct conversations. Chain filters with && to go from hundreds of thousands of packets to the handful that matter.

---

FAQs

What's the difference between a capture filter and a display filter?

Capture filters decide what Wireshark records (set beforehand, BPF syntax). Display filters decide what it shows from an existing capture (typed live during analysis). This cheat sheet covers display filters.

How do I find malicious traffic in Wireshark?

Start from your lead — a suspicious IP, domain, or port from an alert — filter on it, then "Follow TCP Stream" to see the full conversation. Watch DNS queries, odd user agents, and traffic on non-standard ports.

Do I need to memorize all these filters?

No. Memorize ip.addr, protocol names, and tcp.port, and use right-click "Apply as Filter" for the rest. You'll naturally learn more with reps.

Where can I practice Wireshark for SOC work?

Free PCAP samples (like Malware-Traffic-Analysis.net) are great for solo practice. To see packet analysis inside a full investigation, story-driven practice like beginner SIEM scenarios puts network evidence in the context of a real case.

---

Final thought: A packet capture is a haystack. Filters are your magnet. Learn a dozen of them well and you'll never scroll aimlessly again.

How EpicDetect Can Help

Filters are only useful when you know what you're hunting for. Adventures drops you into story-driven SOC investigations where network and log evidence come together into a real case — you follow the thread, not just the syntax. Season 0 is completely free, no credit card required.

Want structured lessons too? The EpicDetect Atlas covers network analysis, SIEM, and detection engineering.

New here? Sign up and start for free.