Wireshark Filters

Search string from tcp
tcp contains facebook

To search HTTP contents from TLSv1.2 protocol
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/


Logical expression

!(ip.src == 192.168.68.18)
!(ip.src == 192.168.68.18) and  (ip.dst == 192.168.69.7)
(ip.src == 192.168.68.18) or  (ip.dst == 192.168.69.7)

IP
ip.addr == 192.168.0.1
ip.src == 192.168.0.1
ip.dst == 192.168.0.1

Input Protocol names directly

tcp
dns
http
udp
tcp or udp

tcp.port == 80

!(arp or dns or icmp)


Packet lost or re-transmission tracking

tcp.analysis.flags


Track one TCP connection
Right click on the record, "Follow TCP Stream"


HTTP Request
http.request
http.response.code == 200

Security usages
If server being attack

tcp.flags.syn == 1
tcp.flags.reset == 1

Signal RTP
sip && rtp