To find any source-routed packets, a display filter would be: tr.sr = 1

For example, a token-ring packet's source route field is Boolean. In a display filter expression testing the value of a Boolean field, 'true' is expressed as 1 or any other non-zero value, and 'false' is expressed as zero. The comparison operators can be expressed either through English-like abbreviations or through C-like symbols: eq, = Equalīoolean values are either true or false. Comparison operatorsįields can also be compared against values. Think of a protocol or field in a filter as implicitly having the 'exists' operator. To see all packets that contain a Token-Ring RIF field, use 'tr.rif'. If you want to see all packets which contain the IP protocol, the filter would be 'ip' (without the quotation marks). The simplest filter allows you to check for the existence of a protocol or field. FILTER SYNTAX Check whether a field or protocol exists A comprehensive reference of filter fields can be found within Wireshark and in the display filter reference at. Display filters let you compare the fields within a protocol against a specific value, compare fields against fields, and check the existence of specified fields or protocols.įilters are also used by other features such as statistics generation and packet list colorization (the latter is only available to Wireshark). If a packet meets the requirements expressed in your filter, then it is displayed in the list of packets. Wireshark and TShark share a powerful filter engine that helps remove the noise from a packet trace and lets you see only the packets that interest you. Wireshark [ -Y 'display filter expression' | b Le or = 10.10.50.1 and ip.Wireshark-filter - Wireshark display filter syntax and reference SYNOPSIS Protocol used in the Ethernet frame, IP packet, or TC segmentĮither all or one of the conditions should matchĮxclusive alterations – only one of the two conditions should match not bothįiltering Packets (Display Filters) Operator Source address, commonly an IPv4, IPv6 or Ethernet address Main Toolbar Items Default Columns In a Packet Capture Output Nameįrame number from the beginning of the packet capture.Keyboard Shortcuts – Main Display Window.Default Columns In a Packet Capture Output.

Wireshark display filters examples