breakfixlearn.com

SEC-03Cybersecurity

Wireshark display filters

Use this when: you need the few packets that matter in a capture: one host, one conversation, errors or suspicious traffic.

Wireshark 4.x, Security+ and CCNA/v1.0//1 page/CC BY-NC 4.0
SEC-03 Wireshark display filters cheat sheet. Every table on it is repeated as text below.
Tap the sheet for the full-size image. The text version below is screen-reader friendly.

Text version

Everything on the sheet, as plain HTML: handy for screen readers, copy-paste and search.

Authorized use only. Capture only on networks you own or may monitor. Captures can hold passwords and personal data: store them encrypted and delete them when done.

Anatomy of a display filter

Type it in the bar above the packet list. Example: ip.addr == 192.0.2.10 && tcp.port in {80,443}, made of a field, an operator, a value, logic, a second field, a set operator and set values. The bar turns green for a valid filter, red for a syntax error and yellow when you should check it.

Display filterCapture filter
WhenAfter capture, change anytimeBefore capture, fixed
SyntaxWireshark fieldsBPF (libpcap)
Exampletcp.port == 80tcp port 80
Use forFinding packetsSmaller files

Operators

C-likeEnglishMeaning
==eqEqual (any value matches)
!=neNot equal (all values, 3.6+)
> < >= <=gt lt ge leCompare numbers
&& || !and or notCombine or negate
containsField has this text
matchesRegex, for example "(?i)login"
in {...}In a set: {443, 8000..8080}

Everyday filters

FilterShows
ip.addr == 192.0.2.10To or from a host
ip.src == 192.0.2.0/24From a subnet
!(ip.addr == 192.0.2.10)Hide a host
tcp.port == 443 || udp.port == 53HTTPS or DNS
dns, dhcp, arp, icmpOne protocol
tcp.stream eq 5One conversation
eth.addr == 00:00:5e:00:53:01By MAC

Troubleshoot

FilterShows
tcp.analysis.flagsAny TCP problem
tcp.analysis.retransmissionLost packets
tcp.flags.reset == 1Refused or reset
tcp.analysis.zero_windowReceiver full
dns.flags.rcode != 0DNS errors
http.response.code >= 400Web errors
arp.duplicate-address-detectedIP conflict
icmp.type == 3Unreachable

Security hunting

FilterShows
tcp.flags.syn == 1 && tcp.flags.ack == 0SYN scans
ftp || telnet || http.authorizationCleartext logins
http.request.method == "POST"Form submits
tls.handshake.type == 1Client Hello, see the SNI
frame contains "password"Leaked secrets

Caution. Do not run Wireshark as root or admin. Capture through dumpcap (the wireshark group on Linux) so the GUI stays unprivileged.

Remember

  • Right-click a field, then Apply as Filter
  • Capture filter tcp port 80 is not the same as display filter tcp.port == 80
  • To exclude a host, use !(ip.addr == x)
  • Text values need quotes: "POST"
  • Follow, then TCP Stream rebuilds a conversation
  • Save a filter as a button with the + on the bar

Sources

Go deeper on the blog