What are Wireshark display filters, and how do you use them to isolate specific types of traffic during packet analysis? Provide examples of commonly used filters.

Question

Accepted Answer

Wireshark display filters are expressions applied after a packet capture to control which packets are shown in the interface. Unlike capture filters that limit what is collected, display filters work on the full dataset and can be changed without recapturing, making them essential for efficient analysis.

Display filters use a dot-notation syntax based on protocol dissector names. The basic format references a protocol field and compares it to a value using operators like equals, not equals, greater than, or contains. You can combine multiple conditions using logical operators: and, or, and not.

For IP address filtering, ip.addr == 10.20.30.40 shows all traffic to or from a specific host. To filter by source only, use ip.src == 10.20.30.40, and for destination use ip.dst == 10.20.30.40. To see traffic between two specific hosts, combine them: ip.addr == 10.20.30.40 and ip.addr == 10.20.30.50.

For protocol-specific filtering, tcp.port == 443 shows all HTTPS traffic, while udp.port == 53 isolates DNS queries. You can filter by protocol name alone: dns shows all DNS traffic, http shows HTTP, and icmp shows only ping and related ICMP messages.

For troubleshooting connection issues, tcp.flags.syn == 1 and tcp.flags.ack == 0 shows TCP SYN packets, revealing connection attempts. The filter tcp.analysis.retransmission highlights retransmitted packets, which indicate packet loss or network congestion. Similarly, tcp.analysis.zero_window reveals flow control issues where a receiver's buffer is full.

For HTTP analysis, http.response.code >= 400 shows all error responses, while http.request.method == "POST" filters for POST requests. You can search within packet content using frame contains "search-term" to find packets containing specific text.

Advanced filters allow subnet matching with ip.addr == 10.20.30.0/24 and time-based filtering using frame.time >= "2024-11-15 14:00:00". The filter tcp.time_delta > 1 finds TCP conversations with gaps longer than one second, useful for identifying slow responses.

A practical workflow for mid-level analysts is to start broad and narrow down progressively. Begin with a host or conversation filter, then add protocol-specific conditions to isolate the relevant traffic. Save commonly used filter combinations as bookmarks in Wireshark for quick access during future troubleshooting sessions. The "Prepare a Filter" option in the right-click context menu is also helpful for building filters based on specific packet attributes without memorizing the syntax.