Wireshark Display Filters: A Practical Reference

By Husanjon Ruzaliev · Updated September 23, 2026

Getting oriented with display filters

Display filters are what make Wireshark usable once a capture contains more than a handful of packets. They differ from capture filters (which use BPF syntax and decide what gets recorded) and instead operate on packets already captured, letting you narrow the packet list down to exactly what you need to inspect. As with any packet capture tool, only capture traffic on networks you own or have explicit authorization to monitor; capturing traffic on networks without permission can violate policy or law, regardless of intent.

Syntax basics

Wireshark display filters use field names tied to each dissected protocol, combined with comparison operators. The most common operators are:

• == equals (also written eq)
• != not equal (also written ne)
• > < >= <= numeric comparisons
• contains substring match
• matches regular expression match

A minimal filter is just a protocol or field name, such as http or dns, which shows only packets where that protocol was dissected. The filter bar turns green when the syntax is valid and red when it is not, which is a quick way to catch typos before hitting Enter.

Filtering by address and port

ip.addr == 192.168.1.10

Shows all traffic to or from that address, in either direction. To restrict to one direction only, use ip.src or ip.dst instead of ip.addr.

ip.addr == 10.0.0.0/24

Matches an entire subnet using CIDR notation.

tcp.port == 443

Shows all TCP traffic on port 443, source or destination. Use tcp.srcport or tcp.dstport to be direction-specific, and udp.port for UDP traffic.

tcp.port == 22 && ip.addr == 192.168.1.10

Combines a port and host filter to isolate one conversation.

Filtering by protocol

http

Shows packets Wireshark has dissected as HTTP, including requests and responses.

http.request.method == "GET"

Narrows HTTP traffic down to GET requests only.

dns

Shows all DNS query and response packets.

dns.qry.name contains "example"

Shows DNS queries where the queried name contains a given substring.

tls.handshake.type == 1

Isolates TLS Client Hello messages, useful for checking SNI values and offered cipher suites during a handshake without decrypting anything.

Combining conditions

Wireshark accepts and/&&, or/||, and not/! to build compound filters:

ip.addr == 192.168.1.10 and tcp.port == 80

tcp.flags.syn == 1 and tcp.flags.ack == 0

Isolates SYN packets that are not also ACKs, which is a common way to spot the start of new TCP connections or scan-like connection attempts.

not arp and not icmp

Hides ARP and ICMP noise so you can focus on other traffic types.

(ip.addr == 10.0.0.5 or ip.addr == 10.0.0.6) and tcp.port == 3389

Parentheses group conditions the way you’d expect from other query languages.

Following streams

Right-clicking a packet and choosing “Follow > TCP Stream” (or UDP/HTTP/TLS Stream) reconstructs the full conversation in a readable view and automatically applies a filter like tcp.stream eq 4 to the packet list, isolating just that exchange. This is often faster than manually building an IP-and-port filter when you already have one packet from the conversation you care about.

Common troubleshooting recipes

• Slow connections: tcp.analysis.retransmission surfaces retransmitted segments, which often point to packet loss or an overloaded link.
• Duplicate ACKs: tcp.analysis.duplicate_ack can indicate the receiver is signaling missing data.
• Zero window conditions: tcp.analysis.zero_window flags cases where a receiver’s buffer is full and is throttling the sender.
• Failed DNS lookups: dns.flags.rcode != 0 shows DNS responses with a non-zero response code, such as NXDOMAIN.
• HTTP errors: http.response.code >= 400 isolates client and server error responses.
• Expired or unusual certificates: tls.handshake.type == 11 shows Certificate messages you can inspect further in the packet detail pane.

A note on capture scope

Because Wireshark can reveal unencrypted payloads, credentials in legacy protocols, and detailed metadata about every host on a segment, capture activity should be limited to interfaces and networks you are authorized to monitor. Capturing traffic that belongs to other users or organizations without consent can expose sensitive data and carry legal consequences.

See the Wireshark overview →