kavklaw@llm $ cat wireshark-filters.md
Display filters, capture filters, protocol analysis, and tshark equivalents for packet forensics.
Display Filters (Wireshark filter bar):
- Applied AFTER capture
- Rich syntax with protocol dissectors
- Use these for analysis
- Example: tcp.port == 80
Capture Filters (set before capture starts):
- Applied DURING capture (BPF syntax)
- Reduces capture file size
- Same syntax as tcpdump
- Example: port 80
Key difference: Display filters are more powerful but only filter what's shown.
Capture filters actually reduce what's captured (saves disk/memory).# Filter by IP address
ip.addr == 10.10.10.5 All traffic to/from IP
ip.src == 10.10.10.5 Source IP only
ip.dst == 10.10.10.5 Destination IP only
ip.addr == 10.10.10.0/24 Entire subnet
# Exclude IP
!(ip.addr == 10.10.10.5) Exclude specific IP
ip.src != 10.10.10.5 Source is not this IP
# Multiple IPs
ip.addr == 10.10.10.5 || ip.addr == 10.10.10.6
ip.addr in {10.10.10.5 10.10.10.6 10.10.10.7}
# IPv6
ipv6.addr == fe80::1
ipv6.src == 2001:db8::1# TCP ports
tcp.port == 80 Source OR destination port 80
tcp.srcport == 80 Source port 80
tcp.dstport == 443 Destination port 443
tcp.port in {80 443 8080 8443} Multiple ports
# UDP ports
udp.port == 53 DNS (UDP)
udp.srcport == 67 DHCP server
# Port ranges
tcp.port >= 1 && tcp.port <= 1024 Well-known portseth.addr == aa:bb:cc:dd:ee:ff All traffic to/from MAC
eth.src == aa:bb:cc:dd:ee:ff Source MAC
eth.dst == ff:ff:ff:ff:ff:ff Broadcast frames
eth.dst == aa:bb:cc:dd:ee:ff Destination MAC# TCP flags
tcp.flags.syn == 1 SYN packets
tcp.flags.syn == 1 && tcp.flags.ack == 0 SYN only (no SYN-ACK)
tcp.flags.syn == 1 && tcp.flags.ack == 1 SYN-ACK
tcp.flags.fin == 1 FIN packets
tcp.flags.rst == 1 RST packets (connection refused/reset)
tcp.flags.push == 1 PSH packets (data transfer)
# TCP analysis
tcp.analysis.retransmission Retransmitted packets
tcp.analysis.duplicate_ack Duplicate ACKs
tcp.analysis.zero_window Zero window (flow control)
tcp.analysis.reset TCP resets
tcp.analysis.flags Any TCP analysis flag
# TCP stream
tcp.stream eq 5 Follow specific TCP stream
# TCP options
tcp.options.mss_val MSS value
tcp.window_size_value Window size# All HTTP traffic
http All HTTP packets
# HTTP requests
http.request All requests
http.request.method == "GET" GET requests
http.request.method == "POST" POST requests
http.request.method == "PUT" PUT requests
# HTTP by URI
http.request.uri contains "/admin"
http.request.uri matches ".*\.php$"
http.request.full_uri contains "login"
http.host == "target.com"
http.host contains "target"
# HTTP responses
http.response All responses
http.response.code == 200 200 OK
http.response.code == 302 Redirects
http.response.code >= 400 All errors
http.response.code == 401 Unauthorized
http.response.code == 403 Forbidden
http.response.code == 500 Server error
# HTTP content
http.content_type contains "text/html"
http.content_type contains "application/json"
http.cookie contains "session"
http.set_cookie contains "session"
http.authorization Auth headers present
http.user_agent contains "curl"
# HTTP2
http2 HTTP/2 traffic
http2.header.name == ":method" && http2.header.value == "POST"dns All DNS traffic
dns.qry.name == "target.com" Query for specific domain
dns.qry.name contains "target" Partial domain match
dns.qry.type == 1 A records
dns.qry.type == 28 AAAA records
dns.qry.type == 5 CNAME records
dns.qry.type == 15 MX records
dns.qry.type == 2 NS records
dns.qry.type == 6 SOA records
dns.qry.type == 16 TXT records
dns.qry.type == 33 SRV records
dns.qry.type == 252 AXFR (zone transfer)
dns.flags.response == 1 DNS responses only
dns.flags.response == 0 DNS queries only
dns.flags.rcode != 0 DNS errors (NXDOMAIN, etc.)
dns.flags.rcode == 3 NXDOMAIN (domain doesn't exist)
dns.resp.len > 0 Responses with answers
# DNS exfiltration detection:
dns.qry.name.len > 50 Long DNS queries (possible exfil)
dns.qry.type == 16 TXT records (common for exfil/C2)smb All SMB traffic
smb2 SMB2/3 traffic
smb2.cmd == 5 SMB2 Create (file open)
smb2.cmd == 8 SMB2 Read
smb2.cmd == 9 SMB2 Write
smb2.filename File operations
smb2.filename contains ".exe" Executable file transfer
smb2.filename contains "password"
# SMB authentication
ntlmssp NTLM authentication
ntlmssp.auth.username NTLM usernames
ntlmssp.auth.domain NTLM domainskerberos All Kerberos traffic
kerberos.msg_type == 10 AS-REQ (authentication request)
kerberos.msg_type == 11 AS-REP (authentication reply)
kerberos.msg_type == 12 TGS-REQ (ticket-granting service request)
kerberos.msg_type == 13 TGS-REP (ticket-granting service reply)
kerberos.msg_type == 30 KRB-ERROR
kerberos.CNameString Principal names
kerberos.realm Domain realm
kerberos.error_code == 6 Client not found (user enum)
kerberos.error_code == 24 Pre-auth failed (wrong password)tls All TLS traffic
tls.handshake TLS handshake packets
tls.handshake.type == 1 Client Hello
tls.handshake.type == 2 Server Hello
tls.handshake.type == 11 Certificate
tls.handshake.extensions.server_name SNI (Server Name Indication)
tls.handshake.extensions.server_name contains "target"
tls.record.version == 0x0303 TLS 1.2
tls.record.version == 0x0304 TLS 1.3
tls.alert_message TLS alerts# FTP
ftp All FTP
ftp.request.command == "USER" FTP usernames
ftp.request.command == "PASS" FTP passwords (plaintext!)
ftp.response.code == 230 Successful login
ftp-data FTP data transfer
# SMTP
smtp All SMTP
smtp.req.command == "AUTH" Authentication
smtp.req.command == "MAIL" Sender
smtp.req.command == "RCPT" Recipient
# DHCP
dhcp All DHCP
dhcp.type == 1 DHCP Discover
dhcp.type == 2 DHCP Offer
dhcp.type == 3 DHCP Request
dhcp.type == 5 DHCP ACK
dhcp.option.hostname Hostnames
# ARP
arp All ARP
arp.opcode == 1 ARP Request
arp.opcode == 2 ARP Reply
arp.duplicate-address-detected Duplicate IP (ARP spoofing?)
# ICMP
icmp All ICMP
icmp.type == 8 Ping request
icmp.type == 0 Ping reply
icmp.type == 3 Destination unreachable
icmp.type == 11 Time exceeded (traceroute)
# LDAP
ldap All LDAP
ldap.bindRequest LDAP bind (authentication)
# RDP
rdp Remote Desktop Protocol# AND
ip.src == 10.10.10.5 && tcp.port == 80
ip.src == 10.10.10.5 and tcp.port == 80
# OR
tcp.port == 80 || tcp.port == 443
tcp.port == 80 or tcp.port == 443
# NOT
!arp
not arp
!(ip.addr == 10.10.10.1)
# Comparison operators
== Equal
!= Not equal
> Greater than
< Less than
>= Greater than or equal
<= Less than or equal
contains String contains
matches Regex match (PCRE)# These are set BEFORE starting a capture
host 10.10.10.5 All traffic to/from host
src host 10.10.10.5 Source only
dst host 10.10.10.5 Destination only
net 10.10.10.0/24 Entire subnet
port 80 Port 80 (TCP and UDP)
tcp port 80 TCP port 80 only
udp port 53 UDP port 53 only
portrange 80-443 Port range
src port 80 Source port
dst port 443 Destination port
# Protocol
tcp TCP only
udp UDP only
icmp ICMP only
arp ARP only
# Combinations
host 10.10.10.5 and port 80
host 10.10.10.5 and not port 22
tcp and port 80 and host 10.10.10.5
not broadcast and not multicast Exclude broadcast/multicast
# Size
less 128 Packets smaller than 128 bytes
greater 1024 Packets larger than 1024 bytes# Right-click a packet → Follow → TCP/UDP/HTTP Stream
# Or use display filter:
tcp.stream eq 0 First TCP stream
tcp.stream eq 5 Stream number 5
udp.stream eq 0 First UDP stream
# In tshark:
tshark -r capture.pcap -z follow,tcp,ascii,0 Follow stream 0
tshark -r capture.pcap -z follow,http,ascii,0 Follow HTTP stream# Edit → Preferences → Columns (or right-click column header → Column Preferences)
Useful custom columns:
Source Port tcp.srcport / udp.srcport
Destination Port tcp.dstport / udp.dstport
HTTP Host http.host
HTTP URI http.request.uri
DNS Query dns.qry.name
Server Name (SNI) tls.handshake.extensions.server_name
TCP Stream tcp.stream
TTL ip.ttl
Window Size tcp.window_size_value# FTP credentials (plaintext)
ftp.request.command == "USER" || ftp.request.command == "PASS"
# HTTP Basic Auth
http.authorization
# HTTP POST login forms
http.request.method == "POST" && http.request.uri contains "login"
# Telnet (follow TCP stream to see commands)
telnet
# NTLM authentication
ntlmssp.auth.username# Port scan detection (many SYN, few SYN-ACK)
tcp.flags.syn == 1 && tcp.flags.ack == 0
# ARP spoofing
arp.duplicate-address-detected
# DNS exfiltration (unusually long queries)
dns.qry.name.len > 50
# Large data transfer
tcp.len > 1000
# Beaconing (regular intervals — C2)
# Use Statistics → IO Graph to visualize timing patterns
# ICMP tunnel
icmp && data.len > 48# Extract files from HTTP:
# File → Export Objects → HTTP
# Extract files from SMB:
# File → Export Objects → SMB
# Extract files from TFTP/DICOM/IMF similarly
# Manual extraction: Follow TCP stream → Save as Raw# tshark = command-line Wireshark
# Read pcap
tshark -r capture.pcap
# Apply display filter
tshark -r capture.pcap -Y "http.request"
# Capture live with filter
tshark -i eth0 -f "port 80"
# Show specific fields
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port
# Extract HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
# Extract DNS queries
tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name
# Statistics: endpoints
tshark -r capture.pcap -z endpoints,ip
# Statistics: conversations
tshark -r capture.pcap -z conv,tcp
# Statistics: protocol hierarchy
tshark -r capture.pcap -z io,phs
# Export objects (HTTP)
tshark -r capture.pcap --export-objects "http,/tmp/extracted/"
# Decrypt TLS (with key log file)
tshark -r capture.pcap -o tls.keylog_file:keylog.txt
# Write filtered packets to new file
tshark -r capture.pcap -Y "ip.addr == 10.10.10.5" -w filtered.pcap
# Count packets per protocol
tshark -r capture.pcap -z io,stat,0Statistics → Capture File Properties File info, packet counts
Statistics → Protocol Hierarchy Protocol breakdown
Statistics → Conversations Top talkers (IP, TCP, UDP)
Statistics → Endpoints All seen hosts/ports
Statistics → IO Graphs Traffic over time (detect beaconing)
Statistics → Flow Graph Visual connection flow
Statistics → HTTP → Requests All HTTP requests sorted
Statistics → DNS DNS query statistics
Statistics → Resolved Addresses IP-to-name mappings
Analyze → Expert Information Errors, warnings, notes
Analyze → Follow → TCP Stream Reconstruct conversation