Display Filters in Wireshark
Display filters in Wireshark are used to control which captured network traffic is displayed in the main Wireshark window. While capture filters determine what traffic is captured, display filters allow you to focus on specific types of traffic for analysis.
Understanding Display Filters
Display filters are based on the same powerful filtering language used for capture filters, the "Wireshark Display Filter Syntax." This syntax allows you to create complex filters that target specific protocols, IP addresses, port numbers, and other network characteristics.
Applying Display Filters
To apply a display filter in Wireshark, follow these steps:
- Open Wireshark and capture some network traffic.
- In the main Wireshark window, locate the display filter input field, usually at the top of the window.
- Enter your display filter expression and press Enter.
Here's an example of a display filter that shows only HTTP traffic:
http
This filter will display only the captured packets that are using the HTTP protocol.
Display Filter Syntax
The display filter syntax in Wireshark is similar to the capture filter syntax, but with some additional features and capabilities. Some common display filter expressions include:
- Protocol filters:
tcp
, udp
, icmp
- Port filters:
tcp.port == 80
, udp.port == 53
- IP address filters:
ip.src == 192.168.1.100
, ip.dst == 8.8.8.8
- Logical operators:
and
, or
, not
- Field-specific filters:
http.request.method == "GET"
, dns.qry.name contains "example.com"
You can find a comprehensive list of display filter expressions in the Wireshark documentation.
Combining Capture and Display Filters
It's important to note that capture filters and display filters serve different purposes. Capture filters determine what traffic is recorded, while display filters determine what traffic is shown in the Wireshark interface.
In many cases, you may want to use both capture and display filters together to optimize your analysis workflow. For example, you can use a capture filter to limit the amount of data collected, and then use a display filter to focus on specific types of traffic within the captured data.