The Wireshark GUI does a good job checking syntax when you are creating your filters see below:Īs you can see in the screenshot, this is the correct syntax as the bar is green. In addition to that, you may only want to capture UDP DNS traffic and not TCP, you can specify the protocol You can also negate the capture as we did above under Exclusion by using: If you only want to capture DNS packets as an example, you can use the following filters You can also be deliberate with the direction of the traffic, for instance, I may only want to see the traffic that is sourced from 10.1.30.0/24 or source IP of 10.1.30.1 in this example: Net 10.1.1.0/24 #This will only capture traffic to and from the 10.1.1.0/24 subnet. Host 10.1.1.60 # This will only capture traffic to and from this host You only want to focus on a range of IP addresses The use case for this filter is you do not want to capture packets from the local machine connect to Dropbox, iCloud Drive, etc. In this example, we only want to capture traffic to / or from a particular range of addresses. Ip Inclusion Including hosts and networks If for example, you do not want to capture other possibly non important packets such as broadcast, multicast and spanning tree, you can use the simple but affective filter of If you do not want to see broadcast as an example, you could use Port not 22 # This one will not capture any of your standard SSH port traffic.ĭst host not 10.1.1.60 #This will capture everything EXCEPT traffic to 10.1.1.60 Lets say your IP address is 10.1.1.50 and the destination is 10.1.1.60 in this example: Have you ever started a capture on a device you are SSH’d to and then find that you are sifting through your own connection packets? Here is a filter to use when you want to exclude your connection. It sounds obvious but I will cover it here.Ĭapture Filter – With these filters, only the packets that match the filter will be captured and saved to a pcap or to the buffer.ĭisplay Filter – With the display filter, you can filter out what you are looking at from the throng of data you captured with or without the capture filter. Unfortunately, they are not interchangeable, however they are not difficult and there are many “cheat sheets” out there that can help you, especially if you are not using them on a daily basis. There are two types of filters in Wireshark capture filters and display filters. It is not an exhaustive list but rather some of my “go to’s” In this article I will go through some of the basic filters I use regularly in Wireshark. Wireshark has a multitude of sample captures if you want to step up your packet capture foo. Either way, I win because the problem is solved which is all I really want. They fix the problem and tell me they did nothing. Usually I send them a PCAP with the pertinent info, a doc explaining my theory and two things happen 1. Most of the times, I use it as a tool to show how it is NOT my fault, rather the other side’s. Sniffer apps such as Sniffer Pro, TCPDump, and Wireshark have been paramount for my success in the field. I have a motto I have lived by in my network years, “When in doubt, sniff it out”. OK maybe not but it does show a level of knowledge on the end user if they in fact have Wireshark. When I am working with someone on a GTM or a Zoom type solution and I ask, “Do you have Wireshark installed on your computer”, if they tell me no, I am immediately suspect.

Wireshark filter by port and ip address