While working with Wireshark in the Packet Details panel, you might want to filter on a specific IP address or a particular port number. Once you identify the item of interest, you can right-click to view filter shortcuts and you will see several shortcuts, as shown here:
Although there are many options when you right-click, in the center are the shortcuts that deal with filters. The following options are available:
- Apply as a Filter: When selected, it will create and run a selected field value.
- Prepare a Filter: When selected, it will create and place a selected field value in the display filter area, giving you a chance to make any modifications or add to the filter.
- Conversation Filter: When selected, it allows you to follow the conversations according to protocols, such as Ethernet, IPv4, and TCP, as shown in the following screenshot:
- Colorize with Filter: This allows you to colorize a specific conversation. As you can see, you can select from the many available colors, or you can create your own coloring rule, as shown in the following screenshot:
When you right-click and select either Apply as a Filter or Prepare a Filter, you will see additional choices, as shown in the screenshot named Right-click to view filter shortcuts. The following list shows how you can select simple filters or add logical operators:
- Selected: Selects the current field value.
- Not Selected: Creates a filter that removes the selected field. For example, if I right-click on destination port 443 and select Not Selected, then Wireshark will generate !(tcp.dstport == 443) and place it in the display filter.
- ...and Selected: Adds a field value to the filter.
- ...or Selected: Creates an OR filter.
- ...and not Selected: Adds a filter that removes the selected field.
- ...or not Selected: Creates an OR filter with a filter that removes the selected field.
After working with Wireshark for a while, you may learn some new techniques that will help improve your workflow. Using filters is one of the tools that helps you home in on a problem. The next section provides some suggestions on useful filters that can help you when searching for specific types of traffic.