Wireshark Display Filters: How to Use Them

Wireshark display filters let you narrow down the packets you see in a capture to only those that match a condition you specify, such as a protocol, IP address, or port. You type the filter into the display filter toolbar at the top of the main window, press Enter, and the packet list instantly updates to show only matching packets. This is different from capture filters, which discard packets before they are saved; display filters work on the data you already have.

How Display Filters Work

Display filters use Wireshark’s own filter language, which is based on protocol fields. Each packet is dissected by Wireshark, and the dissectors populate a tree of fields (e.g., ip.src, tcp.port, http.request.method). The filter engine evaluates your expression against those fields for every packet in the capture. If the expression is true, the packet is shown; if false, it is hidden. The underlying capture file is never modified – you can remove the filter at any time to see all packets again.

Key syntax elements:

Comparison operators: == (equals), != (not equal), >, <, >=, <=.
Logical operators: && (AND), || (OR), ! (NOT).
Fields: protocol names followed by a dot and a field name, e.g., ip.src, tcp.dstport, dns.qry.name.
Values: numbers (e.g., 80), IP addresses (e.g., 10.0.0.1), strings in quotes (e.g., "GET"), and booleans (true/false).

Wireshark highlights valid filters in green and invalid ones in red. If your filter is red, it means there is a syntax error or an unknown field – hover over it to see the error message.

Common Display Filter Examples

Here are practical filters you will use often:

ip.addr == 192.168.1.1 – all traffic to or from that IP.
tcp.port == 80 || udp.port == 53 – HTTP or DNS traffic.
http.request.method == "GET" – only HTTP GET requests.
dns.qry.name contains "google" – DNS queries that contain “google”.
tcp.flags.syn == 1 – TCP packets with the SYN flag set (connection attempts).
frame.len > 1000 – packets larger than 1000 bytes.
!(arp) – everything except ARP packets.

Notice the difference between ip.addr (matches either source or destination) and ip.src / ip.dst (specific direction). Use the specific ones when you only want one direction.

How to Choose the Right Filter

Start with the protocol you are interested in – just type tcp, udp, http, dns, etc. Then refine with additional conditions. If you are troubleshooting a specific host, add ip.addr == a.b.c.d. If you are looking at a service, add the port. For application-level issues, filter on the protocol fields, like http.response.code >= 400 for errors. When you are unsure what fields exist, type a protocol name followed by a dot – Wireshark will show a drop-down of available fields. You can also right-click a packet in the list, choose “Apply as Filter” or “Prepare a Filter”, and Wireshark will build the filter for you.

Common Mistakes and Pitfalls

One frequent error is using a capture filter syntax in the display filter bar. Capture filters (like host 10.0.0.1) use a different, simpler syntax and are only valid in the capture options dialog. Display filters require field names and ==. Another mistake is mixing up ip.addr with ip.src/ip.dst – ip.addr matches both directions, which can surprise you. Also, remember that strings are case-sensitive in some contexts; http.request.method == "get" will not match “GET”. Finally, do not forget parentheses when combining AND and OR: tcp.port == 80 || tcp.port == 443 && ip.addr == 1.2.3.4 is interpreted as tcp.port == 80 || (tcp.port == 443 && ip.addr == 1.2.3.4), which may not be what you intended.

Display Filters vs. Capture Filters

Capture filters are applied at the moment packets are captured, and they are much more limited – they only support a small set of primitives (host, port, protocol) and cannot inspect packet contents. Display filters are applied after capture and can use any dissected field. Capture filters are useful for reducing file size on busy networks, but display filters are the primary tool for analysis. You can also save display filters for reuse via the bookmark icon in the filter toolbar.

Performance and Limits

Display filters are fast because Wireshark only evaluates the filter for packets already in memory. However, on very large captures (hundreds of thousands of packets), applying a filter may take a moment. Filters that use contains or matches (regex) are slower than simple equality. There is no hard limit on filter complexity, but extremely long expressions can become hard to read – use the “Filter Expression” button to build them visually. Also note that display filters do not affect the statistics or protocol hierarchy – those are computed on the whole capture, not the filtered view, unless you use “Analyze → Displayed” options.

Frequently Asked Questions

What is the difference between a display filter and a capture filter?

A capture filter is applied before packets are stored – it discards non-matching packets permanently. A display filter only hides packets from view in the current capture; the data is still there. Capture filters are limited to simple conditions like host 10.0.0.1 or port 80, while display filters can use any protocol field and logical operators.

Why does my filter show red in the toolbar?

Red means the filter expression is invalid. Common causes: a typo in a field name, using a capture filter syntax (like host), missing quotes around a string value, or using a field that does not exist. Hover over the red area to see the exact error message, and check the spelling against the field list in the “Filter Expression” dialog.

How do I filter for traffic between two specific IPs?

Use ip.addr == 192.168.1.1 && ip.addr == 192.168.1.2. Because ip.addr matches either source or destination, this requires both IPs to appear in the packet, which only happens when they are communicating with each other. Alternatively, use (ip.src == 192.168.1.1 && ip.dst == 192.168.1.2) || (ip.src == 192.168.1.2 && ip.dst == 192.168.1.1).

Can I save a display filter for later use?

Yes. Click the bookmark icon on the left of the filter toolbar, choose “Manage Display Filters”, and add a name and filter string. You can then select it from the drop-down list at any time. Filters are stored per profile, so they persist across sessions.

How do I filter packets that contain a specific text string?

Use the contains operator on a field, for example frame contains "password" to find packets that contain that string in the raw data. You can also use tcp.payload contains "GET" to search only TCP payloads. For regular expressions, use matches instead, like http.request.uri matches "/api/.*".

Why does my filter work but shows no packets?

It could mean the capture does not contain matching traffic, or the filter is too restrictive. Check the protocol and field names – for instance, tcp.port only works for TCP; UDP uses udp.port. Also verify that the capture is actually running and packets are being received. If you are filtering on a field that only appears in certain packet types, you may need to expand the protocol in the packet details to see the exact field name.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →