Wireshark Tutorial | Filters

In last tutorial to wireshark we saw how to capture packets using wireshark. In this tutorial we will have our look on how to filter them according to need. As told earlier wireshark is not only a sniffing tool it can also be used for testing protocol implementation and network monitoring, it does have lots of filters which many of us hardly ever use
. So here we will discus only those filters which are mostly used.

Filtering by IP address:

Now suppose you want to filter all those packets where IP address 192.168.248.128 is present then you have to type following command in filters,

ip.addr==192.168.248.128

if you also want to filter packets holding IP address 96.17.181.18, then above command will be modified as,

ip.addr==192.168.248.128 && ip.addr==96.17.181.18

where && means AND. If you want to list packets which holds any one IP address from above then the same filter will be written as follows,

ip.addr==192.168.248.128 or ip.addr==96.17.181.18

You can use as many && and or, but keep in mind all commands in wireshark strictly follow mathematical set theory for filtering so you have to be accurate to filter packets.

If you want to filter packets where source IP is 96.17.181.18 and destination IP is 192.168.248.128 then you can specify filters as follows,

ip.src== 96.17.181.18

ip.dst== 192.168.248.128

You can use && and or switches equally with any filter.

Filtering by ports and protocols:

To filter packets by protocols just type name of protocol in filter box. For example TCP, UDP, HTTP, SMTP etc. To add port to filter add name of protocol appended by port number, look at following example,

ip.dst== 192.168.248.128 && tcp.port=443

Above filter will list all packets from TCP port 443 for destination 192.168.248.128

Filtering by MAC address:

You can use following filter to list packets with specified MAC address.

eth.addr=00:0c:29:0e:15:24

eth.src==00:0c:29:0e:15:24

etc.dst==00:0c:29:0e:15:24

Lastly before you specify new filter you have to clear previous filter, to do so press clear button after filtering box.