- Display filter
Enter a display filter string into the text entry field and click the Find button.+For example, to find the three-way handshake for a connection from host 192.168.0.1, use the following filter string:
See AlsoNetwork Packet Capturing and Analysis with WiresharkWireshark/Arp - Wikiversitylimit number of packets I can see in wireshark???Yeah? Is Wireshark illegal too? Because I could get the same data by taking a pc...ip.src==192.168.0.1 and tcp.flags.syn==1
The value to be found will be syntax checked while you type it in. Ifthe syntax check of your value succeeds, the background of the entryfield will turn green, if it fails, it will turn red. For more detailssee Section6.3, “Filtering Packets While Viewing”
- Hexadecimal Value
Search for a specific byte sequence in the packet data.
For example, use “ef:bb:bf” to find the next packet that contains theUTF-8 byte order mark.
- String
- Find a string in the packet data, with various options.
- Regular Expression
- Search the packet data using Perl-compatibleregular expressions. PCRE patterns are beyond the scope of thisdocument, but typing “pcre test” into your favorite search engineshould return a number of sites that will help you test and exploreyour expressions.
