← All cheat sheets

WIRESHARK FILTERS

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

Display filters (and a few capture filters) for SOC pcap triage.
Two filter syntaxes: DISPLAY filters (Wireshark expression, applied after
capture) and CAPTURE filters (BPF, applied while capturing). They are NOT
interchangeable.

DISPLAY FILTER BASICS#

Operators:  ==  !=  >  <  >=  <=
Logic:      and / &&     or / ||     not / !
Membership: ip.addr in {10.0.0.1, 10.0.0.2}
Matching:   contains "string"        (bytes/substring)
            matches "regex"          (PCRE)
Fields are protocol.field, e.g. http.request.method, dns.qry.name.

Press Tab/autocomplete in the filter bar; a green bar = valid filter,
red = invalid, yellow = valid but may behave unexpectedly (e.g. !=).

IP / HOST / SUBNET#

ip.addr == 10.0.0.5            any direction involves this IP
ip.src == 10.0.0.5             source only
ip.dst == 8.8.8.8              destination only
ip.addr == 10.0.0.0/24         whole subnet
not ip.addr == 10.0.0.5        exclude a host (prefer this over !=)
ipv6.addr == fe80::1

PORTS / TRANSPORT#

tcp.port == 443
udp.port == 53
tcp.port == 445 || tcp.port == 3389     SMB or RDP
tcp.flags.syn == 1 && tcp.flags.ack == 0   SYN only (connection attempts)
tcp.flags.reset == 1                    RSTs (refused/teardown)
tcp.analysis.retransmission             retransmits (loss/latency)
tcp.analysis.flags                      any TCP analysis flag
tcp.len > 0                             packets carrying payload

HTTP#

http                                    all HTTP
http.request                            requests only
http.request.method == "POST"
http.request.uri contains "login"
http.host == "example.com"
http.response.code == 200
http.response.code >= 400               client/server errors
http.user_agent contains "curl"
http.cookie

DNS#

dns                                     all DNS
dns.flags.response == 0                 queries only
dns.flags.response == 1                 responses only
dns.qry.name contains "example"
dns.qry.type == 1                       A records (28 = AAAA, 16 = TXT)
dns.flags.rcode != 0                    errors (NXDOMAIN etc.)
dns.count.answers == 0                  no answers (possible NXDOMAIN)
Hunt tip: very long dns.qry.name or many TXT queries -> possible tunneling.

TLS / SSL#

tls                                     all TLS records
tls.handshake                           handshake messages
tls.handshake.type == 1                 ClientHello
tls.handshake.type == 2                 ServerHello
tls.handshake.extensions_server_name    SNI (the requested hostname)
tls.handshake.extensions_server_name contains "example.com"
tls.record.version
tls.alert_message                       TLS alerts (failures)

ARP / ICMP / DHCP#

arp                                     ARP traffic (spoofing review)
arp.duplicate-address-detected          Wireshark-flagged dup address
icmp                                    pings/errors
icmp.type == 8                          echo request
dhcp                                    DHCP (lease activity)

SMB / KERBEROS / LDAP (Windows triage)#

smb || smb2                             file-share traffic
smb2.cmd == 5                           SMB2 Create (file open)
kerberos                                Kerberos auth
kerberos.CNameString                    requesting principal
ldap                                    directory queries
ntlmssp                                 NTLM authentication
frame contains "password"               raw bytes contain string
frame.len > 1400                        large frames
frame.time >= "2026-01-01 00:00:00"     time-based
data-text-lines contains "GET"          text payload

FOLLOW STREAM & EXPORT (GUI)#

- Right-click a packet > Follow > TCP/UDP/HTTP/TLS Stream
  -> reconstructs the conversation; filter bar becomes tcp.stream eq N.
- tcp.stream == 3                        isolate one TCP conversation
- File > Export Objects > HTTP / SMB / TFTP  -> carve transferred files
- Statistics > Conversations             top talkers by bytes/packets
- Statistics > Protocol Hierarchy         protocol breakdown
- Statistics > Endpoints                  per-host totals (map view)
- Statistics > Resolved Addresses         names seen in the capture

CAPTURE FILTERS (BPF -- different syntax!)#

host 10.0.0.5
net 10.0.0.0/24
port 443
tcp port 80 or tcp port 443
not port 22                              exclude your SSH session
src host 10.0.0.5 and dst port 53
tcp[tcpflags] & tcp-syn != 0             SYN packets

TRIAGE WORKFLOW#

1. Statistics > Conversations/Endpoints -> find top talkers & odd peers.
2. Filter to the suspect host: ip.addr == <host>.
3. Check DNS (dns.qry.name) and TLS SNI for the domains contacted.
4. Follow streams of interest; Export Objects to recover files.
5. Note timestamps (UTC) for the IR timeline.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.