Wireshark Commands Cheatsheet: Filters, Syntax & Shortcuts (2026 Update)
Last updated: 12 September 2026 · Applies to: Wireshark 4.4.x / 4.6.x
Wireshark is a free and open-source packet analyzer used for network troubleshooting, protocol analysis, software/protocol development, and security education. This cheatsheet covers CLI capture commands, display filter syntax, common filters by protocol, TShark equivalents, and keyboard shortcuts — everything you need on one page.
Also read: Wireshark Tutorial: Capture and Analyse Network Traffic
Table of Contents
- Capture Interface Options
- Capture Stop Conditions
- Capture Output Options
- Input File Options
- Processing Options
- User Interface Commands
- Display Filter Logical & Comparison Operators
- Common Display Filters by Protocol
- Wi-Fi / 802.11 Frame Filters
- TShark (Command-Line) Examples
- Keyboard Shortcuts
- Coloring Rules & Statistics Tips
- FAQ
Capture Interface Options
| Flag | Description |
|---|---|
-i <interface> |
Name or index of interface (default: first non-loopback) |
-f <capture filter> |
Packet filter in libpcap filter syntax |
-s <snaplen> |
Packet snapshot length (default: 65535) |
-p |
Don’t capture in promiscuous mode |
-k |
Start capturing immediately (default: do nothing) |
-Q |
Quit Wireshark after capturing |
-S |
Update packet display as new packets are captured |
-l |
Turn on automatic scrolling while -S is in use |
-B <buffer size> |
Size of kernel buffer (default: 1MB) |
-y <link type> |
Link layer type (default: first appropriate) |
-D |
Print list of interfaces and exit |
-L |
Print list of link-layer types for the interface and exit |
--list-time-stamp-types |
Print list of timestamp types for interface and exit |
Capture Stop Conditions
| Flag | Description |
|---|---|
-c <packet count> |
Stop after N packets (default: infinite) |
-a duration:NUM |
Stop after NUM seconds |
-a filesize:NUM |
Stop this file after NUM KB |
-a files:NUM |
Stop after NUM files |
Capture Output Options
| Flag | Description |
|---|---|
-b duration:NUM |
Switch to next file after NUM seconds |
-b filesize:NUM |
Switch to next file after NUM KB |
-b files:NUM |
Ring buffer: replace after NUM files |
-A <user>:<password> |
RPCAP password authentication |
Input File Options
| Flag | Description |
|---|---|
-r <infile> |
Set the filename to read from (no pipes or stdin) |
Processing Options
| Flag | Description |
|---|---|
-R <read filter> |
Packet filter in Wireshark display filter syntax |
-n |
Disable all name resolution (default: all enabled) |
-N <flags> |
Enable specific name resolution(s): mntdv |
-d layer_type==selector,decode_as_protocol |
“Decode As” — e.g. tcp.port==8888,http |
--disable-protocol <name> |
Disable dissection of a protocol |
--enable-heuristic <name> |
Enable a heuristic protocol dissector |
--disable-heuristic <name> |
Disable a heuristic protocol dissector |
User Interface Commands
| Flag | Description |
|---|---|
-C <config profile> |
Start with a specified configuration profile |
-Y <display filter> |
Start with the given display filter |
-g <packet number> |
Go to specified packet number after -r |
-J <jump filter> |
Jump to the first packet matching the filter |
-j |
Search backwards for a matching packet after -J |
-m <font> |
Set the font used for most text |
-t a|ad|d|dd|e|r|u|ud |
Output format of timestamps (default: r, relative to first) |
-u s|hms |
Output format of seconds |
-X <key>:<value> |
Extension options (see man page) |
-z <statistics> |
Show various statistics (see man page) |
-w <outfile|-> |
Set output filename, or - for stdout |
-h |
Display help and exit |
-v |
Display version info and exit |
-o <name>:<value> |
Override a preference or recent setting |
-K <keytab> |
Keytab file for Kerberos decryption |
Display Filter Operators
Display filters (used in the filter bar, not the CLI) have their own syntax, separate from capture filters above.
Logical operators
| Operator | Meaning | Example |
|---|---|---|
and / && |
Logical AND — all conditions must match | http and ip.src == 192.168.0.1 |
or / || |
Logical OR — either condition matches | tcp.port == 80 or tcp.port == 443 |
xor / ^^ |
Exclusive OR — exactly one condition matches | ip.addr==10.0.0.1 xor ip.addr==10.0.0.2 |
not / ! |
Negation | !(ip.addr == 192.168.0.1) |
[n] / [...] |
Substring / slice operator | frame[0:3] == 00:1a:2b |
Comparison operators
| Operator | Meaning | Example |
|---|---|---|
eq / == |
Equal | ip.dst == 192.168.1.1 |
ne / != |
Not equal | ip.dst != 192.168.1.1 |
gt / > |
Greater than | frame.len > 1000 |
lt / < |
Less than | frame.len < 128 |
ge / >= |
Greater than or equal | frame.len >= 64 |
le / <= |
Less than or equal | frame.len <= 1500 |
contains |
Substring match | http contains "password" |
matches |
Regex match | http.host matches "^www\\." |
Common Display Filters by Protocol
IP filters
| Task | Filter |
|---|---|
| Filter by IP (either direction) | ip.addr == 10.10.50.1 |
| Filter by source IP | ip.src == 10.10.50.1 |
| Filter by destination IP | ip.dst == 10.10.50.1 |
| Filter by IP range | ip.addr >= 10.10.50.1 and ip.addr <= 10.10.50.100 |
| Filter by multiple IPs | ip.addr == 10.10.50.1 or ip.addr == 10.10.50.100 |
| Exclude an IP | !(ip.addr == 10.10.50.1) |
| Filter by subnet | ip.addr == 10.10.50.0/24 |
| Filter by hostname | ip.host == "example.com" |
Port & TCP/UDP filters
| Task | Filter |
|---|---|
| Filter by port (either direction) | tcp.port == 443 |
| Filter by source port | tcp.srcport == 443 |
| Filter by destination port | tcp.dstport == 443 |
| Filter by UDP port | udp.port == 53 |
| Filter by IP + port together | ip.addr == 10.10.50.1 and tcp.port == 443 |
| SYN packets only | tcp.flags.syn == 1 and tcp.flags.ack == 0 |
| RST packets only | tcp.flags.reset == 1 |
| TCP retransmissions | tcp.analysis.retransmission |
| TCP zero window | tcp.analysis.zero_window |
| Handshake only | tcp.flags.syn == 1 or tcp.flags.fin == 1 |
HTTP filters
| Task | Filter |
|---|---|
| HTTP GET requests | http.request |
| Filter by URL/host | http.host == "example.com" |
| HTTP responses only | http.response |
| HTTP error codes (4xx/5xx) | http.response.code >= 400 |
| Filter by HTTP method | http.request.method == "POST" |
| Search for a string in HTTP traffic | http contains "login" |
DNS filters
| Task | Filter |
|---|---|
| All DNS traffic | dns |
| DNS queries only | dns.flags.response == 0 |
| DNS responses only | dns.flags.response == 1 |
| Filter by queried domain | dns.qry.name == "example.com" |
| Failed DNS lookups | dns.flags.rcode != 0 |
TLS/SSL filters
| Task | Filter |
|---|---|
| All TLS traffic | tls |
| TLS handshake packets | tls.handshake |
| Client Hello (SNI/domain) | tls.handshake.type == 1 |
| Server Hello | tls.handshake.type == 2 |
| Filter by SNI hostname | tls.handshake.extensions_server_name == "example.com" |
ICMP & ARP filters
| Task | Filter |
|---|---|
| All ICMP (ping) traffic | icmp |
| ICMP echo requests | icmp.type == 8 |
| ICMP echo replies | icmp.type == 0 |
| All ARP traffic | arp |
| ARP requests | arp.opcode == 1 |
| ARP replies | arp.opcode == 2 |
MAC / Ethernet & timestamp filters
| Task | Filter |
|---|---|
| Filter by MAC address | eth.addr == 00:70:f4:23:18:c4 |
| Broadcast frames | eth.dst == ff:ff:ff:ff:ff:ff |
| Multicast frames | (eth.dst[0] & 1) |
| Filter by timestamp | frame.time >= "June 02, 2025 18:04:00" |
Wi-Fi / 802.11 Frame Filters
Wireshark groups 802.11 traffic into three frame types:
- Management frame — establishes/maintains the connection between the network device and the client.
- Control frame — manages the integrity of data traffic between device and client.
- Data frame — carries the actual payload data.
| Task | Filter |
|---|---|
| Outgoing management-frame packets | wlan.fc.type==0 |
| Control-frame packets (in/out) | wlan.fc.type==1 |
| Data-frame packets | wlan.fc.type==2 |
| Association requests | wlan.fc.type_subtype==0 |
| Association responses | wlan.fc.type_subtype==1 |
| Probe requests | wlan.fc.type_subtype==4 |
| Probe responses | wlan.fc.type_subtype==5 |
| Beacon frames | wlan.fc.type_subtype==8 |
| Authentication requests | wlan.fc.type_subtype==11 |
| Deauthentication requests | wlan.fc.type_subtype==12 |
| Filter by any MAC (src or dst) | wlan.addr == <MAC-Address> |
| Filter by source MAC | wlan.sa == <MAC-Address> |
| Filter by destination MAC | wlan.da == <MAC-Address> |
TShark Examples
TShark is Wireshark’s command-line counterpart — useful for scripting and headless servers.
# List available interfaces
tshark -D
# Capture on interface eth0, write to file
tshark -i eth0 -w capture.pcapng
# Capture 100 packets only
tshark -i eth0 -c 100
# Apply a capture filter (libpcap syntax)
tshark -i eth0 -f "tcp port 443"
# Read a file and apply a display filter
tshark -r capture.pcapng -Y "http.request"
# Export specific fields to CSV
tshark -r capture.pcapng -T fields -e ip.src -e ip.dst -e tcp.port -E separator=,
Keyboard Shortcuts
| Shortcut | Action |
|---|---|
Ctrl+E |
Start/stop capturing |
Ctrl+F |
Find packet |
Ctrl+G |
Go to packet number |
Tab / Shift+Tab |
Move between screen elements |
↑ / ↓ |
Move to previous/next packet |
Ctrl+↓ / F8 |
Next packet, even if list unfocused |
Ctrl+↑ / F7 |
Previous packet, even if list unfocused |
Ctrl+. |
Next packet in the same conversation (TCP/UDP/IP) |
Ctrl+, |
Previous packet in the same conversation |
Ctrl+R |
Reload the current capture file |
Ctrl+W |
Close the current capture file |
Coloring Rules & Statistics Tips
- View → Coloring Rules lets you visually flag traffic (e.g., red for retransmissions) without writing a filter every time.
- Statistics → Conversations shows a quick summary of every IP/TCP/UDP conversation in the capture — faster than filtering manually when you just need an overview.
- Statistics → Protocol Hierarchy breaks down what percentage of the capture each protocol represents — good first step when triaging an unfamiliar pcap.
- Right-click a packet → Follow → TCP Stream reconstructs the full conversation (e.g., an HTTP request/response) in one readable view.
FAQ
What is the difference between a capture filter and a display filter in Wireshark?
A capture filter (libpcap syntax, e.g. tcp port 443) is applied before packets are captured and permanently discards anything that doesn’t match. A display filter (Wireshark syntax, e.g. tcp.port == 443) is applied after capture and only hides packets from view — the full capture is still saved.
How do I filter by IP address in Wireshark?
Use ip.addr == <IP> to see traffic to or from that address, ip.src == <IP> for traffic only from it, or ip.dst == <IP> for traffic only to it.
How do I filter by port in Wireshark?
Use tcp.port == <port> or udp.port == <port> for traffic on that port in either direction, or tcp.srcport / tcp.dstport to isolate a direction.
How do I see only HTTP traffic in Wireshark?
Type http in the display filter bar for all HTTP traffic, or http.request to see only client requests.
How do I find TCP retransmissions in Wireshark?
Use the filter tcp.analysis.retransmission. Wireshark’s TCP dissector flags these automatically — no manual sequence-number comparison needed.
Can I combine multiple filters in Wireshark?
Yes. Chain filters with and/&& or or/||, e.g. ip.addr == 10.0.0.5 and tcp.port == 443.
What is the difference between Wireshark and TShark?
Wireshark is the full graphical application; TShark is its command-line-only equivalent, using the same filter syntax and dissectors, ideal for scripting and remote/headless captures.
