Wireshark Cheat Sheet: Mastering Packet Capture Filters and Display Filters

When it comes to capturing network traffic, Wireshark is an incredibly powerful tool. With its robust set of features and options, you can filter out unwanted packets and focus on the ones that matter most. In this article, we'll delve into the world of packet capture filters and display filters in Wireshark.

Packet Capture Filters

Wireshark allows you to set up capture filters before starting a packet capture. These filters determine which packets are captured and which are ignored. By default, Wireshark tries to determine if it's running remotely (e.g., via SSH or Remote Desktop), and if so sets a default capture filter that should block out the remote session traffic.

The capture filter looks for SYN packets originating from a local network on specific ports, such as 135, 445, or 1433. Many worms try to spread by contacting other hosts on these ports. For example, the Welchia worm tries to compromise systems by contacting them on port 135.

To set up a custom capture filter, you can use the following syntax: `dst port ` or `src net `. Replace `` with the desired port number and `` with your own network address. For example, to capture all packets going to or from IP address 192.168.0.100, you would use the filter `host 192.168.0.100`.

wireshark cheat sheet

Display Filters

On the other hand, display filters are used to hide some packets from the packet list. These filters can be changed on the fly and do not have the same limitations as capture filters.

Display filters can be used to filter out specific types of traffic, such as DNS (port 53) or HTTP (port 80). For example, to capture only DNS traffic, you would use the filter `port 53`. To capture all non-HTTP and non-SMTP traffic on your server, you would use the filter `host and not (port 80 or port 25)`.

The display filter can be changed above the packet list in Wireshark. To access it, simply click on the 'Display Filter' button at the top of the main window.

In conclusion, Wireshark's packet capture filters and display filters provide a powerful way to control what traffic is captured and displayed. By mastering these features, you can quickly identify and troubleshoot network issues, as well as uncover potential security threats. Whether you're an IT professional or just starting out with Wireshark, this cheat sheet should help you get the most out of these features.

Wireshark cheat sheet