HackBlue

Tools · Wireshark · 08 / 30

Display filters

A display filter hides rows you already captured. The field name comes from the status bar, and the file stays whole.

12 min read · practice only with authorization

The bar above the list

The display filter box sits above the packet list. A green box means the expression parsed. A red box means it did not, and the list is unchanged. Wireshark applies a parsed filter by hiding non-matching rows. Packet numbers stay as they were. Frame 200 is still frame 200 after its neighbors disappear.

Start from a field you clicked. Apply as Filter writes a correct expression for that value. Prepare a Filter writes it without applying, so you can edit it first. Both are safer than typing a field name from memory the first time you use it.

Either side, or one side

ip.addr == 10.8.0.40 matches when that address is the source or the destination. ip.src and ip.dst are the one-sided tests. tcp.port == 443 matches a TCP packet with that source or destination port. The same shape holds for udp.port.

A test that changed meaning across releases: ip.addr != 10.8.0.40. Since Wireshark 3.6, != means “no address equals this,” so it hides the host. Older builds treated it as “some address differs,” which stays true for almost every packet. The ~= operator still has that older meaning. The spelling that reads the same on every version is the negated positive test: !(ip.addr == 10.8.0.40).

Snippet
ip.addr == 10.8.0.40 && tcp.port == 443

Worked case: only the lab client’s HTTPS

The morning file from the lab mirror is busy. You want the client 10.8.0.40 and TCP port 443. The filter is ip.addr == 10.8.0.40 && tcp.port == 443. The list shows the handshake, the encrypted records, and the teardown for those conversations. DNS from the same client disappears, which is what you asked for.

You need the DNS as well, still only from that client. Change the filter to ip.addr == 10.8.0.40 && (tcp.port == 443 || udp.port == 53). Parentheses matter. and binds tighter than you may remember from English, so group the ports on purpose. The status bar shows how many packets passed, and that count belongs in the note next to the filter.

Clear it before you trust a statistic

Statistics such as Conversations and Protocol Hierarchy can follow the display filter or ignore it, depending on a checkbox in that window. Look at the checkbox before you quote a count. A count taken with a filter on is a count of the view. Say so.

Save the expression in your notes, not only in Wireshark’s filter history. The history is local to the profile. The note is what the next person applies.

Diagram

From a field you clicked to a list that shows only that question

  1. Click

    Select the field. Read its name in the status bar.

  2. Apply

    Apply as Filter, then edit the value if you need a wider test.

  3. Either side

    ip.addr and tcp.port match source or destination. ip.src is one side only.

    Display filter
    ip.addr == 10.8.0.40 && tcp.port == 443
  4. Count

    Read the displayed packet count and copy the filter into the note.

Check yourself

1. Which display filter shows TCP/443 involving 10.8.0.40 in either direction?

2. You want to hide every frame that touches 10.8.0.40. Which expression does that?

3. The filter box turns red. What does the packet list show?