Rakin's Archive

10_Wireshark_Cheatsheet

8 min read

Section 10: Wireshark Cheatsheet & Practical Analysis

10.1 Display Filters vs Capture Filters

Capture Filters (BPF Syntax)

  • Applied during capture
  • Reduces capture file size
  • Cannot be changed while capturing
  • Uses Berkeley Packet Filter (BPF) syntax
  • Set in: Capture > Options > [interface] > Capture filter

Display Filters (Wireshark Syntax)

  • Applied after capture
  • Filters what you see, not what’s captured
  • Can be changed anytime
  • Richer, more powerful syntax
  • Set in: Filter toolbar at top of window

Syntax Comparison

PurposeCapture Filter (BPF)Display Filter (Wireshark)
Host IPhost 192.168.1.1ip.addr == 192.168.1.1
Source IPsrc host 192.168.1.1ip.src == 192.168.1.1
Dest IPdst host 192.168.1.1ip.dst == 192.168.1.1
Portport 80tcp.port == 80
Port rangeportrange 10000-20000tcp.port >= 10000
Protocoltcp, udp, icmptcp, udp, icmp
Networknet 192.168.1.0/24ip.addr == 192.168.1.0/24
Notnot, !not, !
Andand, &&and, &&
Oror, ||or, ||

10.2 Display Filter Quick Reference

IP and Ethernet Filters

IP Address Filters:

FilterDescription
ip.addr == 192.168.1.1Traffic to/from IP
ip.src == 192.168.1.1Source IP only
ip.dst == 192.168.1.1Destination IP only
ip.addr == 192.168.1.0/24Entire subnet
ip.src == 192.168.1.0/24Source from subnet
!(ip.addr == 192.168.1.1)Exclude IP
ip.addr == 192.168.1.1 || ip.addr == 192.168.1.2Multiple IPs

IPv6 Filters:

FilterDescription
ipv6.addr == fe80::1IPv6 address
ipv6.src == 2001:db8::1IPv6 source
ipv6All IPv6 traffic

Ethernet Filters:

FilterDescription
eth.addr == aa:bb:cc:dd:ee:ffMAC address (src or dst)
eth.src == aa:bb:cc:dd:ee:ffSource MAC
eth.dst == aa:bb:cc:dd:ee:ffDestination MAC
eth.dst == ff:ff:ff:ff:ff:ffBroadcast frames
eth.type == 0x0800IPv4 frames
eth.type == 0x0806ARP frames
eth.type == 0x86ddIPv6 frames

ARP Filters:

FilterDescription
arpAll ARP traffic
arp.opcode == 1ARP requests
arp.opcode == 2ARP replies
arp.src.proto_ipv4 == 192.168.1.1ARP for specific IP

TCP and UDP Filters

TCP Filters:

FilterDescription
tcpAll TCP traffic
tcp.port == 80Source OR dest port 80
tcp.srcport == 443Source port 443
tcp.dstport == 22Destination port 22
tcp.port == 80 || tcp.port == 443Multiple ports
tcp.port >= 1 && tcp.port <= 1024Port range

TCP Flags:

FilterDescription
tcp.flags.syn == 1SYN flag set
tcp.flags.ack == 1ACK flag set
tcp.flags.fin == 1FIN flag set
tcp.flags.reset == 1RST flag set
tcp.flags.push == 1PSH flag set
tcp.flags.syn == 1 && tcp.flags.ack == 0SYN only (new connections)
tcp.flags.syn == 1 && tcp.flags.ack == 1SYN-ACK

TCP Analysis:

FilterDescription
tcp.analysis.retransmissionRetransmissions
tcp.analysis.duplicate_ackDuplicate ACKs
tcp.analysis.lost_segmentLost segments
tcp.analysis.zero_windowZero window
tcp.analysis.window_fullWindow full
tcp.analysis.fast_retransmissionFast retransmits
tcp.analysis.flagsAny TCP analysis flags

TCP Stream:

FilterDescription
tcp.stream == 5Follow specific stream
tcp.len > 0TCP with payload
tcp.len == 0TCP without payload (ACKs, etc.)

UDP Filters:

FilterDescription
udpAll UDP traffic
udp.port == 53DNS port
udp.srcport == 67DHCP server
udp.dstport == 5060SIP destination
udp.length > 100UDP larger than 100 bytes

Protocol-Specific Filters

DNS:

FilterDescription
dnsAll DNS traffic
dns.qry.name == "example.com"Query for domain
dns.qry.name contains "google"Domain contains string
dns.qry.type == 1A record queries
dns.qry.type == 28AAAA record queries
dns.qry.type == 15MX record queries
dns.flags.response == 0DNS queries only
dns.flags.response == 1DNS responses only
dns.flags.rcode == 0Successful (NOERROR)
dns.flags.rcode == 3NXDOMAIN (not found)

HTTP:

FilterDescription
httpAll HTTP traffic
http.requestHTTP requests
http.responseHTTP responses
http.request.method == "GET"GET requests
http.request.method == "POST"POST requests
http.response.code == 200200 OK responses
http.response.code >= 400Error responses
http.host == "example.com"Host header
http.request.uri contains "/api"URI contains string
http.content_type contains "json"JSON content
http.user_agent contains "Mozilla"Browser traffic

TLS/SSL:

FilterDescription
tlsAll TLS traffic
tls.handshakeTLS handshake only
tls.handshake.type == 1Client Hello
tls.handshake.type == 2Server Hello
tls.handshake.type == 11Certificate
tls.record.content_type == 23Application Data
tls.alert_messageTLS alerts
tls.handshake.extensions.server_name == "example.com"SNI

DHCP:

FilterDescription
dhcpAll DHCP traffic
dhcp.type == 1DHCP Discover
dhcp.type == 2DHCP Offer
dhcp.type == 3DHCP Request
dhcp.type == 5DHCP ACK
bootp.hw.mac_addr == aa:bb:cc:dd:ee:ffSpecific client

ICMP:

FilterDescription
icmpAll ICMP traffic
icmp.type == 8Echo request (ping)
icmp.type == 0Echo reply
icmp.type == 3Destination unreachable
icmp.type == 11Time exceeded (traceroute)

VoIP Filters (SIP/RTP)

SIP:

FilterDescription
sipAll SIP traffic
sip.Method == "INVITE"INVITE requests (call setup)
sip.Method == "BYE"BYE requests (call end)
sip.Method == "REGISTER"Registration
sip.Method == "ACK"ACK messages
sip.Status-Code == 200200 OK responses
sip.Status-Code == 180Ringing
sip.Status-Code >= 400Errors (4xx, 5xx, 6xx)
sip.From contains "1234"From extension 1234
sip.To contains "4321"To extension 4321
sip.Call-ID == "unique-id"Specific call

RTP:

FilterDescription
rtpAll RTP traffic
rtcpAll RTCP traffic
rtp.p_type == 0PCMU (G.711 u-law)
rtp.p_type == 8PCMA (G.711 A-law)
rtp.ssrc == 0x12345678Specific SSRC
rtp.marker == 1Marker bit set

10.3 Capture Filter Quick Reference

Host Filters:

FilterDescription
host 192.168.1.1Traffic to/from host
src host 192.168.1.1Source only
dst host 192.168.1.1Destination only
not host 192.168.1.1Exclude host

Network Filters:

FilterDescription
net 192.168.1.0/24Entire subnet
net 192.168.1.0 mask 255.255.255.0Same as above
src net 10.0.0.0/8Source from network

Port Filters:

FilterDescription
port 80TCP/UDP port 80
tcp port 443TCP port 443 only
udp port 53UDP port 53 only
src port 67Source port 67
dst port 5060Destination port 5060
portrange 10000-20000Port range

Protocol Filters:

FilterDescription
tcpTCP only
udpUDP only
icmpICMP only
arpARP only
ipIPv4 only
ip6IPv6 only

Combining Filters:

FilterDescription
host 192.168.1.1 and tcp port 80Host AND port
tcp port 80 or tcp port 443Multiple ports
host 192.168.1.1 and not port 22Exclude port
(host 192.168.1.1 or host 192.168.1.2) and tcpGrouped conditions

Special Filters:

FilterDescription
broadcastBroadcast traffic
multicastMulticast traffic
not broadcast and not multicastExclude broadcast/multicast
ether host aa:bb:cc:dd:ee:ffSpecific MAC address

10.4 Filter Operators and Syntax

Comparison Operators

OperatorAliasDescriptionExample
==eqEqualip.addr == 192.168.1.1
!=neNot equalip.addr != 192.168.1.1
>gtGreater thanframe.len > 100
<ltLess thantcp.window_size < 1000
>=geGreater or equalhttp.response.code >= 400
<=leLess or equaltcp.port <= 1024

Logical Operators

OperatorAliasDescriptionExample
&&andLogical ANDip.src == 192.168.1.1 && tcp.port == 80
||orLogical ORtcp.port == 80 || tcp.port == 443
!notLogical NOT!arp

String Operators

OperatorDescriptionExample
containsString containshttp.host contains "google"
matchesRegex matchhttp.host matches ".*\\.com$"
~Regex (alternate)http.host ~ "api"

Membership Operators

OperatorDescriptionExample
inValue in settcp.port in {80, 443, 8080}
inString sethttp.request.method in {"GET", "POST"}

Slice Operators

OperatorDescriptionExample
[n:m]Byte sliceeth.src[0:3] == aa:bb:cc
[n]Single byteip.proto[0] == 6

Parentheses for Grouping

Use () for grouping and precedence:

(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 80

10.5 Practical Analysis Workflow

Step 1: Initial Assessment

  • Statistics > Capture File Properties - Duration, size, packets
  • Statistics > Protocol Hierarchy - Protocol distribution
  • Statistics > Conversations - Top talkers
  • Statistics > Endpoints - All hosts

Step 2: Identify Traffic Patterns

  • Statistics > I/O Graph - Traffic over time
  • Look for spikes, patterns, anomalies
  • Identify time ranges of interest

Step 3: Filter Down

  • Apply display filters to focus on specific traffic
  • Right-click > Follow > TCP/UDP Stream (conversation view)
  • Right-click > Apply as Filter (quick filtering)

Step 4: Deep Analysis

  • Examine specific packets in detail pane
  • Check TCP analysis flags for problems
  • Use expert info: Analyze > Expert Information

Step 5: Document Findings

  • File > Export Packet Dissections - Save analysis
  • File > Export Specified Packets - Save subset
  • Take screenshots of relevant views

Common Analysis Scenarios

Slow Web Page Load:

  1. Filter: http.host == "slowsite.com"
  2. Check: DNS resolution time (dns.time)
  3. Check: TCP handshake time
  4. Check: Time to first byte (HTTP response)
  5. Check: tcp.analysis.retransmission
  6. Follow TCP stream to see request/response

Connection Refused:

  1. Filter: tcp.flags.reset == 1
  2. Look for RST packets
  3. Check: icmp.type == 3 (unreachable)
  4. Verify destination port is correct
  5. Check if SYN-ACK received before RST

Packet Loss / Retransmissions:

  1. Filter: tcp.analysis.retransmission
  2. Filter: tcp.analysis.duplicate_ack
  3. Check: tcp.analysis.lost_segment
  4. Statistics > TCP Stream Graph > Round Trip Time
  5. Look for patterns (specific host, time of day)

VoIP Quality Issues:

  1. Telephony > VoIP Calls (list all calls)
  2. Telephony > RTP > RTP Streams
  3. Check: Lost packets percentage
  4. Check: Jitter values (should be < 30ms)
  5. Filter: rtp && ip.addr == 192.168.1.130
  6. “Play Streams” to hear audio quality

DHCP Issues:

  1. Filter: dhcp
  2. Look for DORA sequence (Discover, Offer, Request, ACK)
  3. Check: dhcp.type == 6 (NAK = failure)
  4. Verify server is responding to Discover
  5. Check for duplicate IP addresses

DNS Resolution Problems:

  1. Filter: dns
  2. Check: dns.flags.rcode != 0 (errors)
  3. Check: dns.flags.rcode == 3 (NXDOMAIN)
  4. Verify DNS server is responding
  5. Check response time: dns.time > 1

10.6 Statistics Menu Quick Reference

General Statistics

Menu ItemDescription
Capture File PropertiesFile info, duration, size
Protocol HierarchyBreakdown by protocol
ConversationsCommunication pairs (L2-L4)
EndpointsAll source/destination addresses
Packet LengthsSize distribution

Network Statistics

Menu ItemDescription
Resolved AddressesHostname resolutions
IPv4 StatisticsIP-specific stats
IPv6 StatisticsIPv6-specific stats

TCP Statistics

TCP Stream Graphs:

  • Round Trip Time - RTT over time
  • Throughput - Bandwidth over time
  • Window Scaling - Window size changes
  • Stevens-style - Classic time-sequence

Protocol-Specific

Menu ItemDescription
DNSDNS statistics
HTTP > RequestsHTTP request statistics
HTTP > Load DistributionRequest distribution
HTTP > Packet CounterHTTP packet counts

I/O Graph

  • Customizable traffic graph
  • Add multiple filter-based series
  • Export as image

Flow Graph

  • Sequence diagram (ladder diagram)
  • Great for TCP handshakes, SIP calls

10.7 Keyboard Shortcuts

ShortcutAction
Ctrl+GGo to packet number
Ctrl+FFind packet
Ctrl+NNext packet matching filter
Ctrl+BPrevious packet matching filter
Ctrl+HomeFirst packet
Ctrl+EndLast packet
TabMove between panes

Capture

ShortcutAction
Ctrl+EStart capture
Ctrl+KStop capture
Ctrl+RRestart capture

File

ShortcutAction
Ctrl+OOpen capture file
Ctrl+SSave capture file
Ctrl+Shift+SSave As
Ctrl+WClose file
Ctrl+QQuit Wireshark

Editing

ShortcutAction
Ctrl+CCopy
Ctrl+Shift+CCopy as Filter
Ctrl+MMark/Unmark packet
Ctrl+TToggle time display format

Display

ShortcutAction
Ctrl+HHide display filter toolbar
Ctrl+/Apply display filter
Ctrl+Shift+OEdit preferences
Ctrl++Zoom in
Ctrl+-Zoom out

10.8 Color Rules Reference

Default Color Rules

ColorMeaning
Light PurpleTCP
Light BlueUDP
Light GreenHTTP
Light YellowICMP/IGMP
PinkTCP errors (RST, problems)
Black on RedBad checksum, malformed
Black on YellowWarnings
Green on WhiteRouting protocols
CyanBroadcast/Multicast

Customize

View > Coloring Rules

  • Add custom rules
  • Modify existing rules
  • Import/Export rule sets

Temporary Coloring

View > Colorize Conversation

  • Quick color specific conversation
  • 10 preset colors available

10.9 Quick Reference Card

Print This!

Essential Display Filters

FilterDescription
ip.addr == XTraffic to/from IP
ip.src == XSource IP
ip.dst == XDestination IP
tcp.port == XTCP port
udp.port == XUDP port
tcp.flags.syn == 1SYN packets
tcp.analysis.flagsTCP problems
eth.addr == XMAC address
arpARP traffic
icmpICMP traffic
httpHTTP traffic
dnsDNS traffic
tlsTLS traffic
sipSIP traffic
rtpRTP traffic

Operators

CategoryOperators
Comparison==, !=, >, <, >=, <=
Logical&&, ||, ! (and, or, not)
Stringcontains, matches
Membershipin {a, b, c}

Capture Filters (BPF)

FilterDescription
host XTraffic to/from host
src host XSource only
dst host XDestination only
net X/YSubnet
port XPort
tcp port XTCP port
udp port XUDP port
portrange X-YPort range

Key Shortcuts

ShortcutAction
Ctrl+GGo to packet
Ctrl+FFind
Ctrl+EStart capture
Ctrl+KStop capture
TabSwitch panes
Ctrl+/Apply filter

Statistics Menu

  • Protocol Hierarchy
  • Conversations
  • Endpoints
  • I/O Graph

Telephony Menu (VoIP)

  • VoIP Calls
  • RTP Streams
  • SIP Flows
  • Play Streams

10.10 Chapter Summary

Key Takeaways

Display vs Capture Filters:

  • Capture: BPF syntax, applied during capture
  • Display: Wireshark syntax, applied after capture

Common Filter Patterns:

  • ip.addr == X - Traffic to/from IP
  • tcp.port == X - TCP port (src or dst)
  • tcp.flags.syn == 1 - SYN packets
  • tcp.analysis.flags - TCP problems
  • [protocol] - All traffic for protocol

Analysis Workflow:

  1. Statistics > Protocol Hierarchy (overview)
  2. Statistics > Conversations (top talkers)
  3. Apply filters to focus
  4. Follow streams for detail
  5. Check Expert Information

VoIP Analysis:

  • Telephony > VoIP Calls (call list)
  • Telephony > RTP > RTP Streams (quality)
  • Play Streams to hear audio

Keyboard Shortcuts:

  • Ctrl+G: Go to packet
  • Ctrl+F: Find packet
  • Tab: Switch panes

Previous: 09_VoIP_Protocols | Home: 00_Table_of_Contents

Graph View

Backlinks