A Wireshark cheat sheet is a quick-reference guide that lists the most useful capture filters, display filters, keyboard shortcuts, and tshark commands in one place. It exists because Wireshark offers hundreds of filter options, and no one can memorize them all. This guide gives you the exact syntax you need, organized so you can find it in seconds.
Whether you’re troubleshooting a slow network, hunting for security threats, or studying for a certification exam, this page is built to be bookmarked and reused.
How to use this cheat sheet
Skim the table headers to find the category you need (IP, ports, protocols, TCP flags, HTTP), then copy the exact filter string into Wireshark’s filter bar. Use Ctrl+F on this page to jump straight to a keyword like “retransmission” or “POST.”
What Is Wireshark and Why You Need a Cheat Sheet
Wireshark is a free, open-source network protocol analyzer. It captures traffic passing over a network interface and lets you inspect every packet in detail: source and destination addresses, protocol, flags, and payload. Learning to navigate Wireshark display filters and Wireshark capture filters is the single biggest skill jump for anyone doing packet analysis.
The problem is speed. In a live troubleshooting session, you don’t have time to browse documentation. A cheat sheet solves that by putting the right filter syntax in front of you instantly, so you can isolate the traffic that matters and ignore the noise.
Capture Filters vs Display Filters
This is the single most confused topic for new Wireshark users. Capture filters and display filters look similar but work completely differently, and mixing up their syntax is the most common mistake beginners make.
| Feature | Capture Filters | Display Filters |
|---|---|---|
| When applied | Before capture starts | After packets are captured |
| Syntax base | BPF (Berkeley Packet Filter) | Wireshark’s own filter language |
| Can be changed mid-capture | No | Yes, anytime |
| Purpose | Reduce what gets recorded | Reduce what gets shown |
| Example | host 192.168.1.1 | ip.addr == 192.168.1.1 |
| Performance impact | Lowers file size and memory use | No effect on capture, only on view |
| Set in | Capture Options dialog | Filter bar at top of window |
Simple rule: Capture filters decide what Wireshark records. Display filters determine what Wireshark shows you from the data it has already captured. If you’re unsure which to use, capture everything and use display filters to narrow it down, you can’t display data you never captured.
Capture Filter Syntax & Essential Examples
Wireshark capture filters use Berkeley Packet Filter (BPF) syntax, the same syntax used by tcpdump. Capture filters are set before you click “Start” in Wireshark.
Basic syntax structure:
[protocol] [direction] [type] [value]Essential Capture Filter Examples
| Filter | What It Does |
|---|---|
| host 192.168.1.10 | Capture only traffic to/from this IP |
| net 192.168.1.0/24 | Capture traffic within this subnet |
| port 80 | Capture only traffic on port 80 |
| portrange 1-1024 | Capture traffic within a port range |
| tcp | Capture only TCP traffic |
| udp | Capture only UDP traffic |
| src host 10.0.0.5 | Capture traffic sourced from this IP |
| dst host 10.0.0.5 | Capture traffic destined for this IP |
| not broadcast and not multicast | Exclude broadcast/multicast noise |
| host 10.0.0.5 and port 443 | Combine host and port conditions |
| ether host aa:bb:cc:dd:ee:ff | Capture traffic for a specific MAC address |
Combine conditions using and, or, and not. For example: host 192.168.1.1 and not port 22 captures all traffic to/from that host except SSH.
Display Filter Syntax, Comparison Operators & Logical Operators
Wireshark display filters are typed into the filter bar and applied instantly to packets already captured. They use field names tied to specific protocols, like ip.addr, tcp.port, or http.request.
Comparison Operators
| Operator | Meaning | Example |
|---|---|---|
| == | Equal to | ip.addr == 10.0.0.1 |
| != | Not equal to | tcp.port != 80 |
| > | Greater than | frame.len > 1000 |
| < | Less than | frame.len < 100 |
| >= | Greater than or equal | tcp.window_size >= 8192 |
| <= | Less than or equal | ip.ttl <= 64 |
| contains | Field contains a string | http contains “login” |
| matches | Regex match | http.host matches “^www\.” |
Logical Operators
| Operator | Symbol | Example |
|---|---|---|
| AND | and or && | ip.addr == 10.0.0.1 and tcp.port == 443 |
| OR | or or | tcp.port == 80 or tcp.port == 443 |
| NOT | not or ! | not arp |
| Exists | (field name alone) | http.request |
Tip: Wireshark’s filter bar turns green when syntax is valid and red when it’s not, a fast way to catch typos.
Most Useful Display Filters
IP Address & Subnet Filters
| Filter | Purpose |
|---|---|
| ip.addr == 192.168.1.1 | Show traffic to or from this IP |
| ip.src == 192.168.1.1 | Show traffic sourced from this IP |
| ip.dst == 192.168.1.1 | Show traffic destined to this IP |
| ip.addr == 192.168.1.0/24 | Show traffic within a subnet |
| !(ip.addr == 192.168.1.1) | Exclude a specific IP |
| ip.addr != 192.168.1.1 && ip.addr != 192.168.1.2 | Exclude multiple IPs |
| ipv6.addr == fe80::1 | Filter IPv6 traffic |
Port-Based Filters
| Filter | Purpose |
|---|---|
| tcp.port == 80 | Show TCP traffic on port 80 |
| udp.port == 53 | Show UDP traffic on port 53 (DNS) |
| tcp.port == 443 | Show HTTPS traffic |
| tcp.dstport == 22 | Show traffic destined to SSH port |
| tcp.srcport == 3389 | Show traffic sourced from RDP port |
| tcp.port >= 1 && tcp.port <= 1024 | Show well-known port range |
Protocol Filters
| Filter | Purpose |
|---|---|
| dns | Show all DNS traffic |
| http | Show all HTTP traffic |
| tls | Show all TLS/SSL traffic |
| arp | Show ARP requests and replies |
| icmp | Show ping and ICMP messages |
| ftp | Show FTP control traffic |
| dhcp | Show DHCP requests/offers |
| ssh | Show SSH traffic |
| smb2 | Show SMB2 file-sharing traffic |
| ntp | Show Network Time Protocol traffic |
TCP Flags & Analysis Filters
These filters rely on your understanding of the TCP three-way handshake, SYN, SYN-ACK, and ACK, to quickly spot connection problems.
| Filter | Purpose |
|---|---|
| tcp.flags.syn == 1 | Show SYN packets (connection attempts) |
| tcp.flags.syn == 1 && tcp.flags.ack == 0 | Show only initial SYN (not SYN-ACK) |
| tcp.flags.reset == 1 | Show RST packets (connection resets) |
| tcp.flags.fin == 1 | Show FIN packets (connection closing) |
| tcp.analysis.retransmission | Show retransmitted packets |
| tcp.analysis.duplicate_ack | Show duplicate ACKs |
| tcp.analysis.zero_window | Show zero window (buffer full) events |
| tcp.analysis.lost_segment | Show detected packet loss |
| tcp.flags == 0x18 | Show PSH-ACK packets |
Understanding TCP flags becomes much more powerful when you also know how the full TCP three-way handshake works in practice. For a clear breakdown of TCP/IP handshakes from a security professional’s perspective, see this guide: TCP/IP handshakes for security professionals.
HTTP / HTTPS Specific Filters
| Filter | Purpose |
|---|---|
| http.request | Show all HTTP requests |
| http.response | Show all HTTP responses |
| http.request.method == “POST” | Show only POST requests |
| http.request.method == “GET” | Show only GET requests |
| http.response.code == 200 | Show successful responses |
| http.response.code == 404 | Show “not found” errors |
| http.response.code >= 400 | Show client/server error responses |
| http.host contains “example.com” | Show requests to a specific host |
| tls.handshake.type == 1 | Show TLS Client Hello messages |
| tls.handshake.extensions_server_name | Show SNI values in TLS handshakes |
Advanced & Troubleshooting Filters
| Filter | Purpose |
|---|---|
| frame.contains “password” | Search all packet bytes for a string |
| frame.len > 1500 | Show oversized frames |
| frame.time_delta > 1 | Show packets arriving more than 1 sec apart |
| expert.severity == “error” | Show packets flagged as errors |
| expert.severity == “warning” | Show packets flagged as warnings |
| dns.flags.rcode != 0 | Show failed DNS responses |
| eth.addr == aa:bb:cc:dd:ee:ff | Filter by MAC address |
| vlan.id == 100 | Filter by VLAN ID |
| icmp.type == 3 | Show ICMP destination unreachable |
| bootp | Show DHCP/BOOTP traffic |
Essential Keyboard Shortcuts
| Shortcut (Windows/Linux) | Shortcut (Mac) | Action |
|---|---|---|
| Ctrl + E | Cmd + E | Start/Stop capture |
| Ctrl + F | Cmd + F | Find packet |
| Ctrl + G | Cmd + G | Go to packet number |
| Ctrl + R | Cmd + R | Restart current capture |
| Ctrl + S | Cmd + S | Save capture file |
| Ctrl + W | Cmd + W | Close capture file |
| Ctrl + Alt + Shift + T | Cmd + Opt + Shift + T | Apply as filter |
| Ctrl + Right-click | Cmd + Right-click | Follow TCP Stream |
| Ctrl + M | Cmd + M | Mark/unmark packet |
| Ctrl + / | Cmd + / | Focus the display filter bar |
| Tab | Tab | Move to next packet field |
| Ctrl + + / − | Cmd + + / − | Zoom in/out on packet bytes |
Follow TCP Stream (right-click any packet → Follow → TCP Stream) is one of the most useful shortcuts in Wireshark. It reassembles an entire conversation between two endpoints into a readable format, which is invaluable for reviewing HTTP requests, login attempts, or file transfers.
Useful tshark Commands
Tshark is Wireshark’s command-line version. It’s ideal for scripting, servers without a GUI, and automated captures.
| Command | Purpose |
|---|---|
| tshark -D | List available network interfaces |
| tshark -i eth0 | Capture on a specific interface |
| tshark -i eth0 -w capture.pcap | Capture and save to a file |
| tshark -r capture.pcap | Read a saved capture file |
| tshark -i eth0 -f “port 80” | Apply a capture filter |
| tshark -r capture.pcap -Y “http.request” | Apply a display filter to a file |
| tshark -i eth0 -c 100 | Capture only 100 packets |
| tshark -r capture.pcap -T fields -e ip.src -e ip.dst | Extract specific fields |
| tshark -r capture.pcap -q -z io,stat,1 | Show traffic statistics per second |
| tshark -r capture.pcap -z conv,tcp | Show TCP conversation summary |
| tshark -i eth0 -a duration:60 | Auto-stop capture after 60 seconds |
-Y applies a display filter (Wireshark syntax); -f applies a capture filter (BPF syntax). Mixing them up is the most common tshark mistake.
Real-World Filter Examples
Finding a slow connection:
tcp.analysis.ack_rtt > 0.5Shows packets where the round-trip acknowledgment took longer than 500ms, a strong sign of latency issues.
How to Detect a Port Scan in 3 Steps
- Capture traffic on the affected interface with no filter, or a broad one like tcp.
- Apply the display filter tcp.flags.syn == 1 && tcp.flags.ack == 0 to isolate connection attempts.
- Check Statistics → Conversations. If a single source IP sends SYN packets to many different destination ports in a short time, that’s a strong port-scan signature.
Port scanning is most commonly performed with Nmap. If you want a complete quick-reference for Nmap commands and the most useful NSE scripts, these two resources pair extremely well with Wireshark analysis: Nmap cheat sheet and Top 10 NSE scripts.
How to Spot Retransmissions on a Specific Host in 3 Steps
- Identify the suspect IP (from a user report or slow-connection complaint).
- Apply the filter tcp.analysis.retransmission && ip.addr == 192.168.1.50.
- Count the hits. Frequent retransmissions on one host usually indicate packet loss, a faulty cable, Wi-Fi interference, or an overloaded link, not the application itself.
How to Find Failed DNS Lookups in 3 Steps
- Apply the filter dns.flags.rcode != 0 to show only DNS responses with an error code.
- Check the query name in each flagged packet to see which hostname failed to resolve.
- Cross-reference the response code (e.g., NXDOMAIN vs. server failure) to decide if it’s a typo, a missing DNS record, or a DNS server outage.
Filtering HTTP POST requests (like login forms):
http.request.method == "POST"Reveals every form submission, useful for security review or debugging web apps.
Isolating traffic during a specific time window:
frame.time >= "2026-08-05 09:00:00" && frame.time <= "2026-08-05 09:15:00"Narrows a large capture down to the exact minutes an incident occurred.
Checking for plaintext credentials:
http contains "password" || ftp contains "PASS"Flags sessions where credentials may be transmitted without encryption.
Once you can reliably capture and filter traffic with Wireshark, the next step for many security professionals is learning how to use that visibility during exploitation. These two guides cover the most widely used frameworks: Metasploit cheat sheet and a broader overview of exploitation frameworks.
Pro Tips for Faster Packet Analysis
- Save filters you reuse. Click the bookmark icon on the left of the filter bar to store frequent filters for one-click access.
- Right-click any field, then “Apply as Filter.” This builds accurate filter syntax automatically, without typing errors.
- Use the Expression button. The button labeled “+” or “Expression” next to the filter bar opens a searchable field browser, so you can build complex filters by clicking through protocol fields and operators instead of memorizing syntax from scratch.
- Use packet coloring rules. View → Coloring Rules lets you visually flag errors, retransmissions, or specific IPs at a glance. Create a dedicated rule for tcp.analysis.flags with a bright color so problem packets jump out immediately while scrolling.
- Combine capture and display filters. Use a broad capture filter to keep file size manageable, then narrow with display filters during analysis.
- Export filtered results. File → Export Specified Packets saves only the packets matching your current filter, useful for sharing evidence.
- Use the Statistics menu. Statistics → Conversations and Statistics → Protocol Hierarchy give a fast overview before you start filtering manually.
- Name your capture profiles. Different jobs (security review vs. performance troubleshooting) benefit from separate saved layouts and filter sets. Edit → Configuration Profiles lets you switch between them in one click, each with its own filter buttons, column layout, and coloring rules.
- Build a “quick filter” toolbar. Save your five most-used filters as filter buttons (Analyze → Display Filter Macros or the “+” tab next to the filter bar) so common views are one click away instead of retyped every session.
Mastering Wireshark filters is most effective when you can practice on a safe, isolated network. Here are two practical guides to help you set up your own environment:
These labs give you a controlled space to capture traffic, test filters, and combine Wireshark with tools like Nmap and Metasploit.
Frequently Asked Questions
What is a Wireshark cheat sheet used for?
A Wireshark cheat sheet gives you fast access to filter syntax, shortcuts, and commands so you don’t have to search documentation during live troubleshooting or analysis.
What is the difference between a capture filter and a display filter in Wireshark?
A capture filter limits which packets Wireshark records, using BPF syntax such as host 10.0.0.1. A display filter limits what’s shown in packets already captured, using syntax such as ip.addr == 10.0.0.1.
How do I filter by IP address in Wireshark?
Use ip.addr == x.x.x.x to see all traffic to or from that address, or ip.src/ip.dst to see only one direction.
How do I find retransmissions in Wireshark?
Type tcp.analysis.retransmission into the display filter bar. This shows every packet Wireshark flagged as re-sent due to a lost or delayed acknowledgment.
How do I see only HTTP traffic in Wireshark?
Type http in the display filter bar for all HTTP traffic, or http.request to see only outgoing requests.
What does tcp.flags.syn == 1 mean?
It filters for packets with the SYN flag set, which marks the start of a TCP connection attempt. Combined with tcp.flags.ack == 0, it isolates only first-contact SYN packets.
How do I follow a full conversation between two devices?
Right-click any packet in that conversation and choose Follow → TCP Stream. Wireshark reassembles the entire exchange into readable order.
What is tshark and how is it different from Wireshark?
Tshark is the command-line version of Wireshark. It uses the same filtering engine but runs without a graphical interface, making it useful for servers and automated scripts.
Can I use display filter syntax inside a capture filter?
No. Capture filters require BPF syntax (host, port, net). Display filter syntax (ip.addr, tcp.port) only works in the display filter bar.
How do I filter out noisy traffic, such as ARP and DNS?
Use not arp and not dns in the display filter bar to hide both protocols and focus on the traffic you’re investigating.
