Wireshark Display Filters: Syntax, Useful Examples and SOC Use Cases

Key takeaways

• A display filter hides packets after capture. A capture filter (BPF) limits what is recorded. They use different syntax.
• The pattern is field operator value. Type a field into the filter bar and Wireshark autocompletes and colours it green or red.
• Combine with && (and), || (or) and! (not). Use parentheses for grouping.
• tcp.port == 80 matches either source or destination port. Use tcp.dstport or tcp.srcport for one direction.
• Filters help to find leads. Always confirm what you see before calling traffic malicious. Capture only where you are authorised.

What is the syntax of a Wireshark display filter?

Most filters follow field operator value, for example ip.src == 192.168.1.10. Operators include ==, !=, >, <, contains (substring), matches (regular expression) and in (a set, such as tcp.port in {80 443 8080}). Combine tests with &&, || and !. The filter bar turns green when valid, red when not. The Wireshark documentation lists every field.

How is this different from a capture filter?

Capture filters such as host 10.0.0.1 and port 53 use BPF syntax and decide what is recorded. Display filters use Wireshark's own syntax and decide what you see. Capture broadly, then filter on screen unless the volume is huge. New to Wireshark? Start with the beginner tutorial.

Which filters should you know?

Addresses and ports

Protocols and application layer

TCP behaviour and problems

One correction to some older guides: tcp.port == 80 does not mean destination port 80. It matches either direction. Use tcp.dstport == 80 for destination only.

How do SOC analysts use filters in practice?

• Possible port scan: filter tcp.flags.syn == 1 && tcp.flags.ack == 0, then use Statistics, Conversations to see one source touching many ports. Many SYNs with resets in return are a lead, not proof.
• Beaconing or odd DNS: filter dns, sort by query name, look for very long random-looking names or repeated queries at regular intervals.
• Cleartext credentials in a lab: filter http.request.method == "POST" and inspect the form data to see why HTTP is unsafe.
• Unexpected outbound services: ip.src == 10.0.0.0/24 &&!(ip.dst == 10.0.0.0/24) && tcp.dstport!= 443 to list internal hosts talking to the internet on unusual ports.
• Slow application: tcp.analysis.retransmission || tcp.analysis.zero_window to see whether the network or the server is the cause.

What tips make filtering faster?

• Right-click a field in the details pane and choose Apply as Filter.
• Save useful filters with the bookmark button, and add filter buttons for the ones you use daily.
• Add important fields as columns, such as tcp.stream or the TLS server name.
• Use Follow, TCP Stream to see one conversation.
• Use Statistics, Protocol Hierarchy and Conversations before filtering, to see where the volume is.
• Read the field name in the status bar when you click a field. That is what you type.

What can filters not do?

They cannot decrypt traffic. For HTTPS, you see handshakes and metadata unless you have session keys in a lab. They also do not decide intent. A SYN burst can be a scanner or a monitoring tool. Check against asset lists and logs.

Legal reminder

Capture only on networks you own or have written authorisation to monitor. Unauthorised interception is an offence under India's IT Act, and captures can contain personal data.

Next steps

To practise filters on real captures, see WebAsha's SOC training. Also read the most important Wireshark filters and Wireshark filters for OT monitoring.

Related reading

• What Are TCP Communication Flags? A Complete Guide to TCP Header Flags (SYN, ACK, FIN, RST, PSH, URG) With Real-Time Examples and Header Structure