How do I filter by protocol?

To filter by protocol in Wireshark, follow these steps:

1. Open Wireshark: Launch the Wireshark application and open your capture file or start capturing traffic.

2. Locate the Display Filter Bar: At the top of the Wireshark window, you will see the display filter bar with the prompt "Apply a display filter".

3. Enter the Protocol Filter:

   • Type the name of the protocol you want to filter. For example:
     • For HTTP traffic, type:

       http

     • For TCP traffic, type:

       tcp

     • For UDP traffic, type:

       udp

     • For ICMP traffic, type:

       icmp

4. Apply the Filter: Press Enter or click the blue arrow button next to the filter bar to apply the filter.

5. View Filtered Results: The packet list will now display only the packets that match the specified protocol, allowing you to focus your analysis on that specific type of traffic.

By using these steps, you can effectively filter packets by protocol in Wireshark.