The first two packets are easy, because those are the only two that have the SYN flag set. Let’s take a look at two examples and how to filter for them: TCP Three Way Handshakeįiltering for the packets of a TCP three way handshake may sound like a simple task, but it isn’t. And even with all the tricks it may still be impossible to use display filters to determine certain things about a trace. While Wireshark can filter on a lot of things, it can’t filter on packet dependencies, at least not without some tricks.

Unfortunately, the developer version 1.99 of the coming Wireshark version 2.0 still does not have this pop-up menu option, so I’m stuck with 1.12.4 for the time being. This will result in an absolute TCP filter, including both IP addresses and ports. One of the most frequent filters I use is the TCP Conversation filter: find a packet belonging to a conversation I want to look at, and use the pop-up menu of the packet list to filter for it: I myself usually only type filters by hand if it’s faster than finding a field I can use with the pop-up menu. Instead of reading the filter name from the status bar and typing it into the filter field you can also right click on the MSS field and select “Apply as filter” from the pop-up menu.

Here’s an example for reading the filter name for the Maximum Segment Size value: Nobody ever saw that he simply picked the correct filter syntax from there, and everyone was very impressed with his Wireshark skills, “memorizing” all these filter expressions 🙂 My buddy Eddi used to impress people with the speed he could tell what the correct filter name was for a field in the decode, but that was just some Wireshark sleigh of hand – whenever you select a field, the status bar will show the according filter in the lower left corner. Basic filteringĪs I said, in really old Wireshark versions, the filter box did not yet help with finding the correct filter, so it often took quite some time to get the filter expression right. We don’t even need the excellent “Wireshark Display Filter” cheat sheets from anymore (well, Jeremy still has a lot of other, really helpful cheat sheets, so check them out). You can filter on almost anything in a packet, and ever since the filter box started suggesting possible filter expressions it got really easy to find the one you wanted. Wireshark has a lot of display filters, and the filtering engine is really powerful.

Wireshark retransmission filter