Wireshark Filter by IP: How To & Examples

To filter packets by IP address in Wireshark, you type a display filter into the filter toolbar at the top of the main window, such as ip.addr == 192.168.1.1, and press Enter. This shows only packets where that IP appears as either the source or destination. For more precise control, you can use ip.src or ip.dst to filter by source or destination only.

Understanding Wireshark Display Filters

Wireshark has two distinct types of filters: capture filters and display filters. Capture filters are set before you start capturing packets and determine which packets are actually recorded to disk. They use a different, more limited syntax based on the pcap filter language (e.g., host 192.168.1.1). Display filters, on the other hand, are applied after capture and only affect what you see on screen. They are far more powerful and use Wireshark’s own filter syntax, which is what most people mean when they say “filter by IP.”

Display filters are evaluated in real time, so you can type a filter and immediately see the matching packets. They do not discard any data; the unfiltered packets remain in the capture file. This makes display filters ideal for troubleshooting because you can quickly switch between different views without re-capturing.

Basic IP Filter Syntax

The core operators for IP filtering are:

• ip.addr == 192.168.1.1 – matches packets where the IP is either source or destination.
• ip.src == 192.168.1.1 – matches packets where the source IP is 192.168.1.1.
• ip.dst == 192.168.1.1 – matches packets where the destination IP is 192.168.1.1.

You can also use != (not equal) and && (and) or || (or) to combine conditions. For example, ip.src == 10.0.0.1 && ip.dst == 10.0.0.2 shows only traffic from 10.0.0.1 to 10.0.0.2. To exclude a specific IP, use ip.addr != 192.168.1.1 – note that this can behave unexpectedly because it excludes any packet where the IP is not the source OR not the destination, which effectively includes packets where it is either. A safer way to exclude an IP is !(ip.addr == 192.168.1.1).

Filtering IPv4 vs IPv6

Wireshark uses separate protocol fields for IPv4 and IPv6. The ip protocol refers only to IPv4. For IPv6, you use ipv6. So to filter by an IPv6 address like 2001:db8::1, you would write ipv6.addr == 2001:db8::1. If you want to see both IPv4 and IPv6 traffic for a host, you can combine them: ip.addr == 192.168.1.1 || ipv6.addr == 2001:db8::1. Many modern networks have both, so this is a common need.

Using the Filter Toolbar and Autocomplete

The filter toolbar is the text box with a green background (turns red if the filter is invalid) at the top of the main Wireshark window. As you type, Wireshark provides autocomplete suggestions for field names and operators. You can also click the bookmark icon to save frequently used filters. To apply a filter, press Enter. To clear it, click the X on the right side of the toolbar or press Ctrl+\ (backslash).

For more complex filters, you can use the Expression dialog (the plus sign next to the toolbar) which lists all available fields and lets you build a filter visually. This is helpful if you’re not sure of the exact field name.

Common IP Filter Examples

Here are some practical examples you might use:

• See all traffic to or from a server: ip.addr == 10.0.0.5
• See only traffic from a specific client: ip.src == 192.168.1.50
• See traffic between two hosts (either direction): ip.addr == 10.0.0.1 && ip.addr == 10.0.0.2
• See all traffic except from a specific host: !(ip.src == 192.168.1.10)
• See DNS queries from a host: ip.src == 192.168.1.1 && udp.port == 53
• See HTTP traffic to a specific IP: ip.dst == 172.16.0.1 && tcp.port == 80

Frequently Asked Questions

Why does ip.addr != 1.2.3.4 not exclude that IP?
Because ip.addr != is true if any IP field in the packet is not equal to 1.2.3.4. Since a packet has both source and destination, it will usually match. Use !(ip.addr == 1.2.3.4) to exclude packets where the IP appears in either field.

How do I filter by IP and protocol at the same time?
Combine conditions with &&. For example, ip.addr == 192.168.1.1 && tcp.port == 443 shows HTTPS traffic to or from that IP. You can also use udp, icmp, etc.

Can I filter by IP range?
Yes, use the ip.addr field with a CIDR notation: ip.addr == 192.168.1.0/24. This matches any IP in that subnet. You can also use ip.src or ip.dst with CIDR.

Why does my filter show no packets even though I see traffic?
Check if you’re capturing on the correct interface, and whether the traffic is IPv4 or IPv6. Also verify the IP address is correct – you can right-click a packet and choose “Apply as Filter” to generate the correct filter.

What is the difference between capture filter and display filter for IP?
Capture filters use the older syntax like host 192.168.1.1 and are applied during capture, reducing the amount of data saved. Display filters use the syntax described here and are applied after capture, only changing what you see.

How do I filter by MAC address instead of IP?
Use eth.addr == aa:bb:cc:dd:ee:ff for Ethernet MAC addresses. This is useful when you want to see traffic from a specific device regardless of its IP (e.g., DHCP traffic before an IP is assigned).

Troubleshooting Common Filter Issues

If your filter doesn’t work as expected, first check the toolbar background: red means the filter syntax is invalid. Look for typos, missing parentheses, or using a field name that doesn’t exist. Also remember that Wireshark is case-sensitive for field names (e.g., ip.src not IP.SRC).

Another common issue is filtering on a field that is not present in the packet. For example, ip.src will not match ARP packets because they don’t have an IP header. In that case, you might want to filter on arp separately. If you’re not seeing expected results, try using the “Apply as Filter” option from a packet that you know matches, and then modify it.

Finally, remember that display filters operate on the currently loaded capture. If you have a very large file, the filter may take a moment to apply, but it should not freeze the UI. If it does, consider using a capture filter to reduce the file size.

Related

• Canva Editor Page Overview & Interface Guide
• Korean SUVs vs Toyota Reliability: The Quirky Proof
• Neighbors Ruining Your Wi-Fi? Fixes That Work