Display Filters

Display filters select the packets shown in every tab. The syntax follows Wireshark's.

Syntax

expression  :=  field operator value  |  field value  |  field  |  protocol
combine with:   and (&&)   or (||)   not (!)   ( ... )
operators   :=  ==  !=  >  <  >=  <=  contains  matches

• field value without an operator means ==: port 53, host 10.0.0.1.
• A field on its own tests that it is present: tcp.flags.
• A bare protocol name matches the transport or application protocol: dns, tls, smb.
• Addresses accept CIDR networks: ip.addr == 192.168.0.0/16.
• contains is a case-insensitive substring; matches is a regular expression.
• Fields with two values (ip.addr, port) match if either value matches; != only if neither does.

Fields

Field	Meaning
ip.src, ip.dst, ip.addr (host)	IPv4/IPv6 addresses
eth.src, eth.dst, eth.addr	MAC addresses
port, srcport, dstport, tcp.port, udp.port	ports
tcp.flags	flag letters, e.g. S, SA, PA, R
tcp.seq, tcp.ack, tcp.len, tcp.window_size	TCP header values / payload length
udp.length	UDP payload length
icmp.type, icmp.code, vlan.id, ip.ttl, ip.version	other header fields
dns.qry.name, http.host, tls.sni	names from the payload
proto	transport or application protocol name
len / frame.len, frame.number, time	frame size, number, seconds from the start
info	the Info column text
expert	TCP analysis notes

TCP analysis keywords: tcp.analysis.flags (any problem), tcp.analysis.retransmission, tcp.analysis.duplicate_ack, tcp.analysis.zero_window, tcp.analysis.reset.

Examples

Filter	Shows
ip.addr == 192.168.1.10	traffic to or from one host
ip.src == 10.0.0.0/8 and tcp.port == 443	HTTPS from the 10.x network
tcp.flags == S	connection attempts (SYN only)
tcp.analysis.flags	packets with TCP problems
dns.qry.name contains "example"	DNS lookups of a domain
tls.sni matches "\.ru$"	TLS sessions to .ru servers
http and info contains "POST"	HTTP form submissions
not (tcp or udp)	everything that is neither TCP nor UDP
len > 1000 and not tls	large non-TLS packets

Press F1 in the application for a quick reference.