Wireshark Display Filters and Capture Filters: Practical Examples

Match the syntax to the field #

Capture syntax such as host does not belong in the display-filter bar. Conversely, ip.addr == is not a libpcap capture expression. The display filter dns selects traffic Wireshark has dissected as DNS, which is a different question from selecting every packet on port 53.

Follow one connection #

ip.addr == 192.0.2.20 && tcp.port == 443

tcp.stream == 4

tcp.flags.syn == 1 && tcp.flags.ack == 0

tcp.flags.reset == 1

tcp.analysis.retransmission || tcp.analysis.fast_retransmission

tcp.analysis.zero_window

Select a packet from the connection, find its TCP stream index, then substitute that number for 4. Stream numbers are local to the capture; the same connection can have another index in a second file. A stream filter prevents unrelated connections to the same server from confusing the timeline.

Turn a filter into a diagnosis #

A SYN without a visible SYN-ACK is evidence about this observation point. It is not automatic proof that the server is down. A reset means a connection was rejected or closed by an endpoint or intermediary; inspect direction and timing. Retransmission analysis is Wireshark's interpretation of the captured sequence, so missing or reordered capture packets can affect the result.

A zero-window indication directs attention toward receiver buffering or application consumption. Compare both directions and the duration before deciding whether the event explains the user-visible delay. Brief events and repeated stalls are different findings.

Preserve context #

Keep the original capture and save the filter used in your incident notes. Include source, destination, protocol and reproduction time. Avoid sharing an unrestricted PCAP when a smaller authorized sample is sufficient. Display filtering alone does not remove hidden packets from the underlying file; export the intended packet subset when preparing evidence for another party.