WIRESHARK CHEAT SHEET
By Hack Academy
Wireshark is a powerful network protocol analyzer that provides deep insights into
network traffic. This cheat sheet offers essential capture and display filters to help you
efficiently analyze and troubleshoot network traffic.
Capture Filters Overview
Capture filters allow you to specify the types of packets you want to capture before the
actual capture starts. They are less flexible than display filters and are used to reduce the
amount of data being captured.
Capture Filters Table
Purpose Filter Example
Traffic to/from a specific IP
host 172.18.5.4
address
Traffic to/from a range of IPs net 192.168.0.0/24
Traffic from a range of IPs src net 192.168.0.0/24
Traffic to a range of IPs dst net 192.168.0.0/24
Only DNS traffic (port 53) port 53
Exclude HTTP and SMTP host www.example.com and not (port 80 or port
traffic 25)
Capture traffic in a port
tcp portrange 1501-1549
range
Capture only Ethernet type
ether proto 0x888e
EAPOL
Capture IPv4 traffic only ip
Unicast traffic only not broadcast and not multicast
port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] =
Capture HTTP GET requests
0x47455420
Wireshark Display Filters Overview
Display filters are applied after the capture to refine the packets shown. These filters
allow you to analyze the traffic captured, providing more flexibility than capture filters.
Display Filters Table
Purpose Filter Example
Show only SMTP (port 25) and ICMP
tcp.port eq 25 or icmp
traffic
ip.src == 192.168.0.0/16 and ip.dst ==
Traffic in the LAN (192.168.x.x)
192.168.0.0/16
TCP buffer full - Source instructs tcp.window_size == 0 && tcp.flags.reset
Destination to stop != 1
Filter Windows-related traffic smb || nbns || dcerpc || nbss || dns
Sasser worm filter ls_ads.opnum == 0x09
Match packets with a specific byte
udp[8:3] == 81:60:03
sequence
Filter by MAC address vendor (DELL) eth.addr[0:3] == 00:06:5B
Match packets containing a byte
udp contains 81:60:03
sequence
Filter SIP packets with specific To-
sip.To contains "a1762"
header values
HTTP requests where the URI ends
http.request.uri matches "gl=se$"
with "gl=se"
Additional Useful Filters Table
Purpose Filter Example
Capture non-RTP traffic (e.g., udp[1] & 1 != 1 && udp[3] & 1 != 1 && udp[8] &
DNS, etc.) 0x80 == 0x80 && length < 250
Capture traffic from a
src net 192.168.0.0/24
specific IP range
Filter PPPoE traffic pppoes
Capture VLAN traffic vlan
Purpose Filter Example
Match packets based on a
http.request.uri matches "gl=se$"
regular expression
Quick Recap
• Capture Filters: Applied before starting the packet capture. They help filter the
traffic captured by specifying IP addresses, ports, or protocols.
• Display Filters: Applied after the packet capture is complete, allowing more flexibility
in narrowing down the packets you are analyzing based on protocol fields and
values.
Closing Notes
Congratulations on taking your first step into Wireshark mastery! Whether you're
troubleshooting network issues or analyzing security threats, Wireshark is an essential
tool for anyone working with network traffic.
As you get more comfortable with using filters, you'll find that you can narrow down even
the most complex captures to reveal exactly what you need. Always remember that
practice makes perfect, and don't hesitate to explore more advanced features of
Wireshark.
Additionally, if you're using Wireshark in a security context, ensure you have proper
authorization to capture traffic. Misuse of network analysis tools can lead to privacy
violations and legal issues. Stay ethical and legal! ⚖
Happy analyzing!
