CATEGORY -PACKET ANALYSISwireshark-display-filters-cheatsheetPacket Capture Forensics & Telemetry

Wireshark Display Filter Syntax & Forensics

Curated display filters for network forensics, protocol hunting, malware beaconing, and security troubleshooting.

Core Purpose & Operating Context

Isolate security-relevant packets instantly during incident response and network forensics.

01.

Network & Transport Layer Filters

IP endpoints, port ranges, and TCP anomaly hunting.

Filter all traffic involving specified IP and TLS port

$ip.addr == 192.168.1.50 && tcp.port == 443

Filter packets identified as TCP retransmissions (packet loss indicator)

$tcp.analysis.retransmission

Display all TCP RST packets

$tcp.flags.reset == 1

02.

Detecting plaintext HTTP exfiltration, tunneling, and DNS queries.

Display only outbound DNS queries

$dns.flags.response == 0

Filter DNS TXT record requests (often abused for DNS tunneling / C2)

$dns.qry.type == 16

Filter HTTP state-mutating requests

$http.request.method in {"POST", "PUT", "DELETE"}

Filter TLS Client Hello packets to inspect Server Name Indication (tls.handshake.extensions_server_name)

$tls.handshake.type == 1

•

Display filters do NOT drop packets from the capture; they only filter the graphical view.

•

To inspect encrypted HTTPS payloads, configure an SSLKEYLOGFILE in the browser and import into Wireshark.