TechKnowSurge
Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.7 Cisco CyberOps Associate 1.10 CompTIA Network+ 5.5 Cisco CyberOps Associate 4.6 CompTIA Network+ 3.2
TechKnowSurge Catalog Videos Filtering Data
VideoNetworkFree

Filtering Data

Wireshark's display filter system allows analysts to isolate specific network traffic by IP address, port, protocol, or direction, cutting through the noise of large packet captures. Filters can be typed manually or applied directly from captured packets using right-click context menus.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

When working with packet captures in Wireshark, large volumes of traffic make filtering an essential skill rather than an optional convenience. The display filter bar supports precise expressions built around protocol fields, allowing analysts to target traffic by IP address, source address, destination address, TCP or UDP port number, and protocol type. For example, filtering on ip.src with a specific address limits the view to packets originating from that host, while tcp.dst.port == 80 isolates only inbound HTTP traffic to port 80, rather than all traffic touching that port in either direction. Beyond manually typed expressions, Wireshark provides right-click shortcuts that streamline filter creation. Selecting a field in the packet detail pane and choosing 'Apply as Filter' automatically constructs and applies the corresponding expression, removing the need to recall exact syntax. The conversation filter option narrows the capture to a single IP or TCP exchange between two endpoints, which is particularly useful when tracing a specific session or connection. Negation filtering adds another layer of control by allowing analysts to exclude specific traffic rather than include it. Prefixing an expression with an exclamation point removes matching packets from the displayed results, which helps clear out noisy or irrelevant protocols like spanning tree that can obscure the traffic under investigation. Together, these techniques give analysts precise control over what appears in the packet list, making it possible to work efficiently even within very large capture files.

What you'll learn

What's covered

Wireshark Packet Filtering

Aligned to

Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
Cisco CyberOps Associate
4.7 Identify key elements in an intrusion from a given PCAP file
1.10 Interpret the 5-tuple approach to isolate a compromised host
4.6 Extract files from a TCP stream when given a PCAP file and Wireshark
CompTIA Network+
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues
3.2 Given a scenario, use network monitoring technologies

Key terms

IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Protocol
A set of rules governing the format and transmission of data between devices.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Display Filter
A Wireshark expression that limits the packets shown in the capture view to those matching specified criteria such as IP address or protocol.
Conversation Filter
A Wireshark filter applied via right-click context menu that isolates all traffic between two specific endpoints in a selected communication session.

Topics

Wireshark Packet Analysis Display Filters Network Traffic Analysis Protocol Filtering Networking

Transcript

Filtering by IP Address

Since we can end up with a lot of packets when we do a packet capture, it's really helpful to know how to do some filtering. We may be looking for some specific information, so I'm just going to show you a few examples of how to do filtering.

The first thing I'm going to do is, in here I can type something like ip, and as you can see there's lots of different options that we have with this. There's a lot of different filtering capabilities this has, so I'm just going to show you a few that I use, and then if you have other things you're looking for, you should be able to sort by pretty much anything in here.

IP address is one that I like to use a lot. Let's say I'm looking for a specific IP address, maybe the ones associated with this machine, so 10.1, 10.34 is the one I'm going to look for. So it's the field, and equal equal, and then what I'm looking for. That is what I'm looking for right there, and it's showing me everything that's communication going to or from this 10130 do34.

But maybe that's not what I want. Maybe what I actually want to do is anything that's sourced from this address, so that would be ip, and then I could do src, and then hit enter, and now anything that's sourced from 10.1.1 10.34, it's showing me that. Or maybe I want to say anything that's destined for this machine or this IP address, so then I can do ip dot destination, or dst.

Filtering by Port

Some other ones that I like to do — a lot of times I like to sort by the port. Maybe I'm going to just remove this altogether, I can hit this x up here. Now maybe next what we want to do is do it by tcp dot port, and I'm going to do equal equal, space, 80, and everything that's going to be HTTP. So now it's showing you everything that's HTTP, but once again, it's showing you everything that is coming in or out that is destined for port 80 or coming into port 80.

Maybe I just want to have a destination of port 80, so dst port equal equal 80, hit enter, and now it's showing just those that are going to port 80.

Applying Filters from the Packet List

There are some other ways to apply filters as well. What I'm going to do is scroll down to the conversation I'm most interested in, which is between this device and that web browser, and I can click one of these fields, right click on it, and say apply as filter, and I'm going to do selected. Then I'll do that, and now it automatically puts in IP destination 10.1.3 23. So that's one way to do it.

There's also this — I can right click on this and do conversation filter, so I can then say what I want to filter by. Maybe I want to see this TCP communication that's happening, so I'm going to select TCP, and it shows me that TCP communication.

Another thing I can do is, let's say maybe something's really distracting — maybe all this spanning tree information is distracting. Another thing I can do is filter based off of something that I don't want. So for instance I can say apply filter, I want this not selected, and hit there, and then it will remove those items. You can see that it does this little exclamation point as the key to that, so I can actually write in my expression up here with an exclamation point to filter or remove certain pieces of information from here as well, which might help clear some of the information out.

In fact, there are things that I don't really use too much, but I can start ignoring packets and doing some stuff to filter out some of the distracting elements of this.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →