Wireshark Filters Cheatsheet: Finding Signals in the Noise

Category: Cheat Sheets

Tags: wireshark, packet-capture, network-forensics, pcap, display-filters

Wireshark captures everything. That's simultaneously its greatest strength and the reason analysts stare at scrolling packets with the same expression people reserve for assembly language. The difference between a useful Wireshark session and drowning in data is knowing which filters to apply.

This cheatsheet covers display filters (applied after capture) and capture filters (applied during). They use different syntax, because apparently one filter language wasn't confusing enough.

Display Filters vs Capture Filters

Rule of thumb: Use capture filters when you know exactly what you want. Use display filters when you're investigating and need to slice the data different ways.

Display Filters -- Protocol

# Filter by protocol
http
dns
tcp
udp
icmp
arp
tls
smb
smb2
ssh
ftp
dhcp
sip

Negate with !:

!arp                                    # Everything except ARP
!(dns || arp || icmp)                   # Cut the noise

Display Filters -- IP Addresses

ip.addr == 10.10.10.5                   # Traffic to OR from this IP
ip.src == 10.10.10.5                    # Source IP only
ip.dst == 10.10.10.5                    # Destination IP only
ip.addr == 10.10.10.0/24               # Entire subnet
!(ip.addr == 10.10.10.1)               # Exclude specific IP

# IPv6
ipv6.addr == fe80::1
ipv6.src == 2001:db8::1

Display Filters -- Ports & Transport

tcp.port == 443                         # TCP port (src or dst)
tcp.srcport == 443                      # TCP source port
tcp.dstport == 80                       # TCP destination port
udp.port == 53                          # UDP port (DNS)
tcp.port in {80, 443, 8080, 8443}       # Multiple ports

# TCP flags
tcp.flags.syn == 1                      # SYN packets
tcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN only (connection initiations)
tcp.flags.rst == 1                      # RST packets (connection resets)
tcp.flags.fin == 1                      # FIN packets (connection teardowns)

# TCP analysis (Wireshark's built-in intelligence)
tcp.analysis.retransmission             # Retransmitted packets
tcp.analysis.duplicate_ack              # Duplicate ACKs
tcp.analysis.zero_window                # Zero window (backpressure)
tcp.analysis.reset                      # Connection resets

Display Filters -- HTTP

http.request                            # All HTTP requests
http.response                           # All HTTP responses
http.request.method == "GET"            # GET requests only
http.request.method == "POST"           # POST requests only
http.request.uri contains "login"       # URIs containing "login"
http.host == "example.com"              # Specific host header
http.response.code == 200               # Successful responses
http.response.code >= 400               # Client/server errors
http.response.code == 401               # Unauthorised
http.response.code == 403               # Forbidden
http.response.code == 500               # Internal server error
http.content_type contains "json"       # JSON responses
http.user_agent contains "curl"         # Requests from curl
http.cookie contains "session"          # Session cookies

Display Filters -- DNS

DNS is one of the most forensically valuable protocols. Every domain lookup leaves a trail.

dns                                     # All DNS traffic
dns.qry.name == "evil.com"              # Specific domain lookup
dns.qry.name contains "evil"            # Partial domain match
dns.qry.type == 1                       # A records
dns.qry.type == 28                      # AAAA records
dns.qry.type == 15                      # MX records
dns.qry.type == 16                      # TXT records (often abused for C2)
dns.flags.response == 1                 # DNS responses only
dns.flags.rcode == 3                    # NXDOMAIN (domain doesn't exist)
dns.resp.len > 0                        # DNS responses with answers
dns.qry.name matches "^[a-z0-9]{32}\." # Potential DGA domains (32-char hex)

Display Filters -- TLS/SSL

tls                                     # All TLS traffic
tls.handshake                           # TLS handshakes only
tls.handshake.type == 1                 # Client Hello
tls.handshake.type == 2                 # Server Hello
tls.handshake.type == 11               # Certificate
tls.handshake.extensions.server_name == "example.com"  # SNI filter
tls.record.version == 0x0301           # TLS 1.0 (deprecated, suspicious)
tls.record.version == 0x0303           # TLS 1.2
tls.alert_message                       # TLS alerts

Display Filters -- SMB

SMB analysis is critical for lateral movement detection.

smb                                     # All SMB traffic
smb2                                    # SMB2/3 traffic
smb2.cmd == 5                          # SMB2 Create (file access)
smb2.cmd == 8                          # SMB2 Read
smb2.cmd == 9                          # SMB2 Write
smb2.filename contains "password"       # Files with "password" in the name
smb2.filename contains ".exe"           # Executable transfers
smb2.share_type == 1                   # Disk shares
smb2.share contains "ADMIN$"           # Admin share access (lateral movement)
smb2.share contains "C$"              # C$ share access
smb2.share contains "IPC$"            # IPC$ (PsExec, WMI)

Display Filters -- Authentication

# Kerberos
kerberos                                # All Kerberos
kerberos.msg_type == 10                # AS-REQ (authentication request)
kerberos.msg_type == 11                # AS-REP (authentication response)
kerberos.msg_type == 12                # TGS-REQ (service ticket request)
kerberos.msg_type == 13                # TGS-REP (service ticket response)
kerberos.error_code == 6               # Principal not found
kerberos.error_code == 24              # Pre-auth failed (wrong password)

# NTLM
ntlmssp                                # All NTLM authentication
ntlmssp.messagetype == 1              # NTLM Negotiate
ntlmssp.messagetype == 2              # NTLM Challenge
ntlmssp.messagetype == 3              # NTLM Authenticate

Forensic Hunting Filters

These filters are specifically useful during incident investigations.

# Beaconing detection (regular intervals to same host)
ip.dst == SUSPECT_IP && tcp.flags.syn == 1

# Large data transfers (potential exfiltration)
tcp.len > 1000 && ip.dst != 10.0.0.0/8

# Suspicious DNS (long subdomains = potential tunneling)
dns.qry.name.len > 50

# Cleartext credentials (FTP, Telnet, HTTP Basic)
ftp.request.command == "PASS"
http.authbasic

# ARP spoofing detection
arp.duplicate-address-detected

# ICMP tunneling (unusually large ICMP packets)
icmp && data.len > 64

# PowerShell download cradle indicators
http.request.uri contains "powershell"
http.request.uri contains "IEX"
http.request.uri contains "downloadstring"

Capture Filters (BPF Syntax)

Applied before capture starts. Different syntax from display filters.

host 10.10.10.5                         # Traffic to/from host
src host 10.10.10.5                     # From host only
dst host 10.10.10.5                     # To host only
net 10.10.10.0/24                       # Entire subnet
port 80                                 # Specific port
src port 443                            # Source port
dst port 53                             # Destination port
tcp                                     # TCP only
udp                                     # UDP only
not arp                                 # Exclude ARP
not broadcast                           # Exclude broadcast
host 10.10.10.5 and port 443           # Combined
tcp portrange 1-1024                    # Port range

Useful Keyboard Shortcuts

What's Next

• Nmap Cheatsheet -- generate the traffic you'll then analyse
• PowerShell Security Cheatsheet -- the other side of network forensics
• Offensive Security 102: Reconnaissance -- put these filters into context