A display filter keeps data within a trace buffer, hiding the traffic you’re disinterested in and displaying only the information you wish to view. Also, you can establish it while the operation is in progress. You can set this type of filter before initiating a capture operation and later adjust or cancel it. It solves the major problem of memorizing different IP-addresses for humans.On the other hand, display filters contain parameters that apply to all captured packets. DNS is a system which stores information about the domains like IP-addresses, mail servers and other information. Every device connected to the internet has a unique IP-address. dnsĭns filter is used to show the dns frames.

arpĪrp filter is a linked layer protocol and is generally used to find the MAC addresses. This filter will find and display all HTTT GET requests. This filter will display all packets that contain the word “ traffic.” It is useful when looking for some specific words. Icmp filter is used to check the reachability of the of a host or router in a network. Tcp filter is used to display all the tcp traffic which is captured from the network. So, if we type i p.dst = 192.168.25.101 then it will show us only the traffic which has 192.168.25.101 as a destination IP-address. Ip.dst is used to only get the traffic which has some particular IP-address as a destination. So, if we type ip.src = 192.168.25.101 then it will show us only the traffic which has 192.168.25.101 as source IP-address. Ip.src is used to only get the traffic which has some particular IP-address as a source. We can also write ip.addr = 192.168.25.101 then it will only show us the traffic which is either sent or received by this IP-address. Ip.addr filter shows all the traffic which is being sent and received by different IP-addresses. Some of the most common ones are following, ip.addr There are lot of filters which can simplify the process of capturing and analysing traffic in a better way. It converts the packets in a human readable form which is quite easy to understand. Wireshark is a very famous packet analysing and capturing tool.

Wireshark filter by source ip address