Core Wireshark display filters to commit to memory
1. ip.addr == 10.0.0.5 – isolates all IPv4 traffic to or from a host.
2. tcp.port == 443 – shows only TLS‑encrypted TCP sessions.
3. http.request.method == "POST" – captures HTTP POST requests.
4. dns.qry.name contains "malware" – flags DNS queries for suspicious domains.
5. frame.time_delta > 0.5 – highlights packets with inter‑arrival gaps > 500 ms (useful for spotting latency‑based exfil).
6. ssl.record.version == 0x0303 && ssl.record.content_type == 23 – filters TLS application‑data records (TLS 1.2+).
7. tcp.flags.syn == 1 && tcp.flags.ack == 0 – lists SYN scans (half‑open connections).
8. icmp.type == 3 && icmp.code == 1 – catches destination‑unreachable (host‑unreachable) messages.
9. eth.addr == aa:bb:cc:dd:ee:ff – isolates traffic from a specific MAC address.
10. udp.port == 53 && !(dns.flags.response == 0) – shows only DNS responses.
Quick reference table
| Filter | Typical use |
|--------|-------------|
| ip.addr | Host‑based slicing |
| tcp.port | Service‑level focus |
| http.request.method | Web‑app payloads |
| dns.qry.name | Threat intel look‑ups |
| frame.time_delta | Timing anomalies |
| ssl.record | Encrypted payload inspection |
| tcp.flags | Scan detection |
| icmp.type | Network error monitoring |
| eth.addr | Layer‑2 forensics |
| udp.port | DNS traffic filtering |
Gotcha: Wireshark evaluates filters case‑sensitively; http.request.method == "post" will never match, so always use the exact case shown in the protocol field.