How to use the Wireshark Filters Cheat Sheet
- 1. Search or browseType a protocol or field, or pick a section.
- 2. Copy a filterEach filter has its own copy button.
- 3. DownloadSave the whole sheet as text or Markdown.
Capture filters vs display filters
Wireshark has two filter languages, and mixing them up is the most common beginner mistake. Capture filters use the BPF syntax from tcpdump (host 10.0.0.5 and port 443) and decide what gets recorded at all; set them before starting, to keep big captures small. Display filters use Wireshark's field names (ip.addr == 10.0.0.5 && tcp.port == 443) and hide or show packets that are already captured, so you can change them as often as you like. The filter bar turns green when a display filter is valid. Everything is calculated in your browser; nothing you enter is uploaded.
For hiding an address, !(ip.addr == x) behaves the same in every Wireshark version, while the meaning of != changed in version 3.6.
Worked example
To investigate a slow website, capture with port 443, then use tls.handshake.extensions_server_name == "uncodemy.com" to find the connections to that site, right-click one and choose Follow → TCP Stream (which sets tcp.stream eq N), and finally tcp.analysis.flags to spot retransmissions or zero-window problems in that conversation.
Tips
- Right-click any field in the packet details and choose Apply as Filter to learn field names.
- Save favourite filters as buttons with the + on the filter bar.
- Capture only on networks you're allowed to monitor; packets can contain other people's data.
Frequently asked questions
Which Wireshark version is this for?
The filters work in current 4.x versions; DHCP was called bootp before 3.0.
Can I decrypt HTTPS?
Only with the session keys, for example by setting the SSLKEYLOGFILE environment variable in your own browser and loading that file in Wireshark.
Is the Wireshark cheat sheet free?
Yes. You can open the Wireshark cheat sheet and use every option without signing up. When you download the sheet for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.