Wireshark is a powerhouse tool for network analysis—but without mastering display filters, you’ll quickly drown in a sea of packets. Display filters let you zero in on exactly the traffic you want to analyze, saving time and making your job way easier.

In this article, we’ll walk through 10 essential display filters that every Wireshark user should know. Whether you're troubleshooting a network issue or investigating suspicious behavior, these filters will help you cut through the noise.

ip.addr == x.x.x.x

Purpose: Show all traffic to or from a specific IP address.

This is one of the most basic and useful filters. It matches both source and destination addresses.

ip.src == x.x.x.x / ip.dst == x.x.x.x

Purpose: Show traffic where the IP is specifically the source or destination.

Use these when you want to isolate traffic direction.

tcp.port == 80

Purpose: Filter all TCP traffic using port 80 (typically HTTP).

This works for both source and destination ports. You can replace 80 with any port: 443 (HTTPS), 21 (FTP), etc.

http

Purpose: Quickly isolate HTTP traffic.

No need to specify ports—this filter targets packets recognized by Wireshark as HTTP.

dns

Purpose: Filter all Domain Name System (DNS) traffic.

Great for troubleshooting DNS resolution issues.

tcp.flags.syn == 1 and tcp.flags.ack == 0

Purpose: Show only initial SYN packets, used during TCP handshake.

Useful when identifying new TCP connection attempts.

tcp contains "password"

Purpose: Search for strings in TCP payloads (in cleartext).

Use this cautiously—it can help during security audits (on unencrypted traffic), but always respect privacy and legality.

arp

Purpose: Filter all Address Resolution Protocol packets.

Handy when diagnosing local network issues like ARP spoofing or MAC address conflicts.

frame contains "example.com"

Purpose: Search for a string anywhere in a packet’s raw data.

Great when you're looking for specific domains, hostnames, or keywords across all protocols.

tcp.analysis.retransmission

Purpose: Find TCP retransmissions (a sign of packet loss or latency).

Excellent filter for diagnosing poor network performance or flaky connections.