basic Wireshark filters

• tcp.port == 25
• ip.addr == 192.0.2.1 this checks both .src and .dst
• ip.src == 192.0.2.1
• ip.dst == 192.0.2.1
• frame matches r"GET /cgi-bin"
  • this uses PCRE (Perl-compatible regex)
  • matches are case-insensitive by default
  • NOTE that you should use raw strings with 'matches', to avoid having to use double-backslashes

Some common protocols you might be interested in:

• dns
  • dns.qry.name == "google.com"
• http
  • http.request || http.response
  • http.request.method == "GET"

Case-insensitive searches:

• frame matches "somefilename\\.ext"
• tcp.payload matches "somefilename\\.ext"

Further documentation on display filters:

• wireshark.org/docs/dfref/ — Display Filter Reference
• wiki.wireshark.org/DisplayFilters
• wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html — Wireshark User’s Guide > Building Display Filter Expressions