There are two common ways to save filters. Just so you know the difference when you search for more commands. The display filter hides filtered packets and is mainly used on already saved packet capture files or live traffic. Capture filters can have a different syntax and won't be tackled in this post. This is mainly for long packet captures or connections/devices with a lot of traffic helpful, and often enough necessary. With this filter turned on, you can start packet capture, and everything filtered out won't be saved. The capture filter - as the name suggests - is a filter for the capturing of packets itself. Difference display filter and capture filter Capture filter

As mentioned before, I'll add IPv6 filters, some more context for when I use certain filters, more topics like OSPF, HTTP/s, and so others, and some more functions. In an attempt to keep it to the basics, I left out topics like functions, variables, macros, arithmetic operators, and some other advanced things. I'd appreciate it, and I am happy to learn.

If you think I forgot something important or want to share more tips, feel free to reach out. I've added links to the specific category to every protocol in the rest of the post. Nevertheless, a list of all display filters can be found here. In general, it is recommended to use the right-click function to add specific protocols/ fields/ values, etc, to the filter. There is no way to list every filter, and I try to concentrate on the most commonly used ones. Wireshark offers a wide range of tools that are out of this post's scope. In this post, I'll focus on the display filters for IPv4 only.

The display filter is used to filter a packet capture file or live traffic, and it is essential to know at least the basics if you want to use Wireshark for troubleshooting and other evaluations. This post is a quick reference for using the display filters in Wireshark.

Wireshark dns filter