One of the most frequent filters I use is the TCP Conversation filter: find a packet belonging to a conversation I want to look at, and use the pop-up menu of the packet list to filter for it: I myself usually only type filters by hand if it’s faster than finding a field I can use with the pop-up menu. Instead of reading the filter name from the status bar and typing it into the filter field you can also right click on the MSS field and select “Apply as filter” from the pop-up menu. Here’s an example for reading the filter name for the Maximum Segment Size value: Nobody ever saw that he simply picked the correct filter syntax from there, and everyone was very impressed with his Wireshark skills, “memorizing” all these filter expressions 🙂 My buddy Eddi used to impress people with the speed he could tell what the correct filter name was for a field in the decode, but that was just some Wireshark sleigh of hand – whenever you select a field, the status bar will show the according filter in the lower left corner. Basic filteringĪs I said, in really old Wireshark versions, the filter box did not yet help with finding the correct filter, so it often took quite some time to get the filter expression right. We don’t even need the excellent “Wireshark Display Filter” cheat sheets from anymore (well, Jeremy still has a lot of other, really helpful cheat sheets, so check them out). You can filter on almost anything in a packet, and ever since the filter box started suggesting possible filter expressions it got really easy to find the one you wanted. Wireshark has a lot of display filters, and the filtering engine is really powerful.

Wireshark filter http packet