--- title: The best Wireshark filters for troubleshooting. description: Discover essential Wireshark filters for efficient network analysis and troubleshooting. Learn how to capture actionable network data. image: https://insights.profitap.com/hubfs/Blank%20diagram%20(5).jpeg --- [![Profitap](https://insights.profitap.com/hubfs/profitap-logo-white-rev1.png "Profitap")](https://www.profitap.com) - [Solutions](https://www.profitap.com/solutions/) - Products - Resources - Company - - - - # Profitap Blog ### Recent Posts ### Categories - [Network Monitoring (75)](https://insights.profitap.com/topic/network-monitoring) - [Insights (38)](https://insights.profitap.com/topic/insights) - [IOTA (32)](https://insights.profitap.com/topic/iota) - [Copper TAPs (31)](https://insights.profitap.com/topic/copper-taps) - [ProfiShark (24)](https://insights.profitap.com/topic/profishark) - [Fiber TAPs (23)](https://insights.profitap.com/topic/fiber-taps) - [Data Center (17)](https://insights.profitap.com/topic/data-center) - [Network Packet Brokers (14)](https://insights.profitap.com/topic/network-packet-brokers) - [Network Visibility and Cybersecurity (14)](https://insights.profitap.com/topic/network-visibility-and-cybersecurity) - [Network Security (13)](https://insights.profitap.com/topic/network-security) - [News (13)](https://insights.profitap.com/topic/news) - [Product Update (11)](https://insights.profitap.com/topic/product-update) - [Field Service (10)](https://insights.profitap.com/topic/field-service) - [Case Study (3)](https://insights.profitap.com/topic/case-study) - [OIDA (3)](https://insights.profitap.com/topic/oida) - [Events (2)](https://insights.profitap.com/topic/events) - [Heroes of Packet Analysis (2)](https://insights.profitap.com/topic/heroes-of-packet-analysis) - [Solutions for Government and Defense (2)](https://insights.profitap.com/topic/solutions-for-government-and-defense) - [Power and Utilities Solutions (1)](https://insights.profitap.com/topic/power-and-utilities-solutions) - [Solutions for Logistics (1)](https://insights.profitap.com/topic/solutions-for-logistics) - [cloud (1)](https://insights.profitap.com/topic/cloud) see all ### Archives - [July 2026 (1)](https://insights.profitap.com/archive/2026/07) - [June 2026 (1)](https://insights.profitap.com/archive/2026/06) - [May 2026 (3)](https://insights.profitap.com/archive/2026/05) - [April 2026 (2)](https://insights.profitap.com/archive/2026/04) - [March 2026 (3)](https://insights.profitap.com/archive/2026/03) - [February 2026 (3)](https://insights.profitap.com/archive/2026/02) - [January 2026 (3)](https://insights.profitap.com/archive/2026/01) - [November 2025 (1)](https://insights.profitap.com/archive/2025/11) - [October 2025 (4)](https://insights.profitap.com/archive/2025/10) - [September 2025 (1)](https://insights.profitap.com/archive/2025/09) - [August 2025 (2)](https://insights.profitap.com/archive/2025/08) - [July 2025 (3)](https://insights.profitap.com/archive/2025/07) - [May 2025 (1)](https://insights.profitap.com/archive/2025/05) - [March 2025 (2)](https://insights.profitap.com/archive/2025/03) - [February 2025 (3)](https://insights.profitap.com/archive/2025/02) - [January 2025 (2)](https://insights.profitap.com/archive/2025/01) - [December 2024 (1)](https://insights.profitap.com/archive/2024/12) - [November 2024 (2)](https://insights.profitap.com/archive/2024/11) - [October 2024 (1)](https://insights.profitap.com/archive/2024/10) - [September 2024 (3)](https://insights.profitap.com/archive/2024/09) - [August 2024 (8)](https://insights.profitap.com/archive/2024/08) - [July 2024 (7)](https://insights.profitap.com/archive/2024/07) - [June 2024 (1)](https://insights.profitap.com/archive/2024/06) - [May 2024 (6)](https://insights.profitap.com/archive/2024/05) - [April 2024 (1)](https://insights.profitap.com/archive/2024/04) - [March 2024 (3)](https://insights.profitap.com/archive/2024/03) - [February 2024 (2)](https://insights.profitap.com/archive/2024/02) - [January 2024 (1)](https://insights.profitap.com/archive/2024/01) - [December 2023 (2)](https://insights.profitap.com/archive/2023/12) - [November 2023 (1)](https://insights.profitap.com/archive/2023/11) - [July 2023 (1)](https://insights.profitap.com/archive/2023/07) - [June 2023 (1)](https://insights.profitap.com/archive/2023/06) - [April 2023 (1)](https://insights.profitap.com/archive/2023/04) - [February 2023 (1)](https://insights.profitap.com/archive/2023/02) - [January 2023 (1)](https://insights.profitap.com/archive/2023/01) - [December 2022 (1)](https://insights.profitap.com/archive/2022/12) - [October 2022 (1)](https://insights.profitap.com/archive/2022/10) - [April 2022 (1)](https://insights.profitap.com/archive/2022/04) - [March 2022 (1)](https://insights.profitap.com/archive/2022/03) - [February 2022 (2)](https://insights.profitap.com/archive/2022/02) - [January 2022 (1)](https://insights.profitap.com/archive/2022/01) - [December 2021 (2)](https://insights.profitap.com/archive/2021/12) - [October 2021 (2)](https://insights.profitap.com/archive/2021/10) - [September 2021 (1)](https://insights.profitap.com/archive/2021/09) - [August 2021 (1)](https://insights.profitap.com/archive/2021/08) - [June 2021 (1)](https://insights.profitap.com/archive/2021/06) - [May 2021 (1)](https://insights.profitap.com/archive/2021/05) - [March 2021 (2)](https://insights.profitap.com/archive/2021/03) - [February 2021 (1)](https://insights.profitap.com/archive/2021/02) - [January 2021 (2)](https://insights.profitap.com/archive/2021/01) - [November 2020 (1)](https://insights.profitap.com/archive/2020/11) - [September 2020 (1)](https://insights.profitap.com/archive/2020/09) - [August 2020 (1)](https://insights.profitap.com/archive/2020/08) - [July 2020 (2)](https://insights.profitap.com/archive/2020/07) - [June 2020 (2)](https://insights.profitap.com/archive/2020/06) - [April 2020 (2)](https://insights.profitap.com/archive/2020/04) - [March 2020 (2)](https://insights.profitap.com/archive/2020/03) - [February 2020 (4)](https://insights.profitap.com/archive/2020/02) - [September 2019 (1)](https://insights.profitap.com/archive/2019/09) - [August 2019 (1)](https://insights.profitap.com/archive/2019/08) - [May 2019 (2)](https://insights.profitap.com/archive/2019/05) - [April 2019 (1)](https://insights.profitap.com/archive/2019/04) - [March 2019 (1)](https://insights.profitap.com/archive/2019/03) - [February 2019 (1)](https://insights.profitap.com/archive/2019/02) - [December 2018 (2)](https://insights.profitap.com/archive/2018/12) - [October 2018 (2)](https://insights.profitap.com/archive/2018/10) - [August 2018 (1)](https://insights.profitap.com/archive/2018/08) - [July 2018 (2)](https://insights.profitap.com/archive/2018/07) - [June 2018 (1)](https://insights.profitap.com/archive/2018/06) - [May 2018 (4)](https://insights.profitap.com/archive/2018/05) - [April 2018 (1)](https://insights.profitap.com/archive/2018/04) - [March 2018 (2)](https://insights.profitap.com/archive/2018/03) - [February 2018 (1)](https://insights.profitap.com/archive/2018/02) - [January 2018 (1)](https://insights.profitap.com/archive/2018/01) - [December 2017 (1)](https://insights.profitap.com/archive/2017/12) - [November 2017 (2)](https://insights.profitap.com/archive/2017/11) - [October 2017 (1)](https://insights.profitap.com/archive/2017/10) - [July 2017 (1)](https://insights.profitap.com/archive/2017/07) - [May 2017 (2)](https://insights.profitap.com/archive/2017/05) - [February 2016 (1)](https://insights.profitap.com/archive/2016/02) - [December 2015 (2)](https://insights.profitap.com/archive/2015/12) - [June 2015 (2)](https://insights.profitap.com/archive/2015/06) - [May 2015 (3)](https://insights.profitap.com/archive/2015/05) see all ### Stay up to date [Follow @Profitap](https://twitter.com/Profitap) [Return to Blog](https://insights.profitap.com/) # The best Wireshark filters for troubleshooting. - [Tweet](https://twitter.com/share) Analyzing network behavior and troubleshooting network issues is like going through a funnel. Ultimately, you go from a wide-angle perspective down to microscopic detail. Wireshark, a well-known network protocol analyzer, helps network engineers do exactly this. It helps them filter specific data segments, such as particular IP addresses, values, or protocols, making the troubleshooting process more manageable. Starting with a capture or trace file of your network’s traffic, filters can be applied to narrow down your search to specific data segments, such as particular IP addresses, values, or protocols, making the troubleshooting process more manageable.  ![image (4)-1](https://insights.profitap.com/hs-fs/hubfs/image%20(4)-1.png?width=800&height=573&name=image%20(4)-1.png) # Wireshark Filters: Essential Tools for Network Analysis We put together a list of useful filters to make data analysis more efficient. These filters, applicable to both live captures and imported files, enable precise examination of protocol fields and data stream HEX values, tailored to the unique needs of each troubleshooting scenario. Here are their top picks:   **ip.addr == x.x.x.x** Filters packets with a specific IP address as either the source or destination. Ideal for analyzing traffic to and from a particular IP.   **ip.addr == x.x.x.x && ip.addr == y.y.y.y** Narrows down communication between two IP addresses, streamlining data analysis. Wireshark keeps track of specific conversations between endpoints on various levels of the protocol stack and lets you filter explicitly for those. Take a look at the Statistics->Conversations dialog to get a list of conversations that are part of the currently open trace.   **http or dns** Focuses on HTTP and DNS protocols, facilitating the investigation of web traffic and domain name resolutions.   **tcp.port == xxx** Isolates TCP packets by specific port numbers, simplifying the examination of traffic through designated ports. If you need to filter for multiple ports you can also supply a list of values to filter for: tcp.port in {80, 443}. This will filter for all traffic either on port 80 or 443.    **tcp.seq == x** Filters packets by TCP sequence number, useful for analyzing data packet order.   **tcp.flags.reset==1** Reveals all TCP resets, crucial for identifying abrupt connection terminations.   **tcp.flags.push == 1** Identifies TCP push events, significant for troubleshooting data flow issues.   **tcp contains "keyword"** Displays TCP packets containing specified terms, aiding in content-specific searches. Note, that the string within the quotes will be escaped. Therefore searching for a file-patch may yield unexpected results. To avoid this, one can also force the search to avoid escaping the content, e.g.: tcp contains r"C:\\foo"   **tcp.stream eq X** Follows a particular TCP stream, allowing for continuous packet tracking. To see an overview of all streams available in a specific trace, the Statistics->Conversations dialog can be used.   **http.request** Captures HTTP GET and POST requests, highlighting web page access patterns. Specifically it will capture all packets, where the field http.request is present. If only a specific request should be filtered for, it can be specified accordingly: http.request.method in {"POST", "PUT"}   **!(arp or icmp or dns)** Excludes specified protocols, focusing the analysis on relevant traffic.   **udp contains xx:xx:xx** Filters UDP packets by HEX values, useful for pinpointing specific data segments.   **dns.flags.rcode != 0**  Identifies DNS requests with resolution errors, crucial for diagnosing domain name issues.   **tcp.payload\[0:2\] == bb:cc**  Filters the payload field for all messages that contain bb:cc as the first two bytes. This can be used in various places, eth.addr\[0:3\] == 00:11:32 will filter all traffic originating from a NIC with a Synology vendor ID for instance. Don't forget to check [The Evolution of Portable Packet Capture Solutions](https://insights.profitap.com/evolution-of-portable-packet-capture) article if you want to learn more about a portable network capture solution that flawlessly integrates with Wireshark. # *Pro tips* ## *1. Did you know that you can add often-used filters as a button?* ![](https://lh7-us.googleusercontent.com/R4n1jWuFEasnkUnaNc5zoK79bLAcCN-m_uu_suXCAwKkoHqSlJucOGMuP4jicXmKldPpiq3Bz5K502704qOaD-tuRnqZSRXVByqceWnXxnfS683B1CIaRSTyy2FM-Kyt-tXmH-t5EvbZ74shQ06nqGE) The little + on the right side of the address bar allows for the creation of so-called “Filter Buttons”. Those buttons can be used as shortcuts for often-used display filter expressions.  New buttons can be added by either dragging a field directly onto the + sign or by clicking it when a filter is applied. In the latter case, it will automatically add the current filter to the creation dialog and all that is needed is to provide a name for the button. By adding two slashes // to the name, the buttons can even be grouped together. ## 2. Did you know that you can drag and drop filters? Instead of just copying the filters it is easier just to drag a filter into the search bar. ``` In this video Chris greer explains the drag and drop capability in 2 minutes. ```   # ***Capturing actionable network data*** Network packets can make or break your troubleshooting process. One key advantage of network packet capture is the level of detail it provides. Capturing all information within a packet, including its source and destination addresses, protocol information, and payload data, allows for a more thorough analysis of network traffic, making it an invaluable tool for troubleshooting network issues. Packet capture tools like the ProfiShark or IOTA have advanced features such as hardware timestamping and hardware capture filters, delivering high-fidelity capture files for analysis. | ![profitap-capture-and-analysis-solutions-profishark-800px](https://insights.profitap.com/hs-fs/hubfs/profitap-capture-and-analysis-solutions-profishark-800px.png?width=300&height=174&name=profitap-capture-and-analysis-solutions-profishark-800px.png)   | ![profitap-iota-solution-overview-edge-800px](https://insights.profitap.com/hs-fs/hubfs/profitap-iota-solution-overview-edge-800px.png?width=250&height=203&name=profitap-iota-solution-overview-edge-800px.png) | | --- | --- | | [![Discover Profishark](https://no-cache.hubspot.com/cta/default/2954816/interactive-165154139218.png)](https://insights.profitap.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKdyrhU%2BDROyMfpZGxyMw0ZxATzWWlcwTqTjEeZ6huTcgw76FFTXJtux53duGCdL90rxyQAk%2BeZ1AJ0oTrWa9y%2BeUPb7ApbjXmRqnVqkhFbUVLgVo8O7ZKub8im4KnOKI1IDT87fP0C5TIcgYXPW18ktVh7jwjmLB9QSL1nFHdUvCvwo8PFmqq2D0gksXj%2F1alvE08%3D&webInteractiveContentId=165154139218&portalId=2954816) | [![Discover IOTA EDGE](https://no-cache.hubspot.com/cta/default/2954816/interactive-165495420848.png)](https://insights.profitap.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLcNQc%2B7l4YzYQqRDg6FSDVbxfrzrCS10ovDKlSDBR2mcHCp6Dfr%2FxZtZ8iQfYGPpDWWrAgb1hHiwk1vWyghv8ESyDpB98ZqQwMorNY%2F7tDPdFwBZqK4oMS%2F%2FDi9qNEhKJz6ttOQHZSxl7tKELsom9HFTRlF5FmMiuIORQHvgKs975%2FJQ%3D%3D&webInteractiveContentId=165495420848&portalId=2954816) | | High-performance field packet capture for on-site troubleshooting and industrial networks.‎ - High-fidelity field traffic capture - Hardware timestamping - Non-intrusive traffic access - Combine with Wireshark or any PCAP analyzer - Fail-safe | Traffic capture & analysis in a single box. Small/mid-size enterprises and data centers. - Deployed on edge and remote sites - Integrated analysis dashboards - In-line or out-of-band - 1 TB or 2 TB capture storage - Capture performance 3.2 Gbps |   [![CTA Traffic Capture & Analysis_v3](https://no-cache.hubspot.com/cta/default/2954816/interactive-159642100996.png)](https://insights.profitap.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIpppmV%2BLIRa2aIkzV0XlgX0TMgrNClfd43MJ%2FZJyp8s%2B7kAnzZN%2F40q%2FQM1h6mgHOXeZq%2F%2BrKd60Q8pjG8DCRnC0mgP6SUS4PtpB4UMs1AP1Xg8h45YCxNEGX5vTOo46MGNAb703tS3cMRCfdgOdTSo2zQUtjuy9EaHwvcNx%2FacaCYlf7z1uS1zv98%2B1qQxI7I1Bpb&webInteractiveContentId=159642100996&portalId=2954816)   - [Tweet](https://twitter.com/share) by [Profitap](https://insights.profitap.com/author/profitap) | Apr 22, 2024 | [ProfiShark](https://insights.profitap.com/topic/profishark), [Network Monitoring](https://insights.profitap.com/topic/network-monitoring) [**Packet Capture & Analysis**](https://www.profitap.com/iota/) - [IOTA 1G](https://www.profitap.com/iota-1g/) - [IOTA 1G+](https://www.profitap.com/iota-1g-plus/) - [IOTA 10G](https://www.profitap.com/iota-10g/) - [IOTA 10G+](https://www.profitap.com/iota-10g-plus/) - [IOTA 10 CORE](https://www.profitap.com/iota-10-core/) - [IOTA 10 CORE+](https://www.profitap.com/iota-10-core-plus/) - [IOTA 100 CORE](https://www.profitap.com/iota-100-core/)   [**ProfiShark**](https://www.profitap.com/profishark-network-taps/) - [ProfiShark 100M](https://www.profitap.com/profishark-100m/) - [ProfiShark 1G](https://www.profitap.com/profishark-1g/) - [ProfiShark 1G+](https://www.profitap.com/profishark-1g-plus/) - [ProfiShark 10G](https://www.profitap.com/profishark-10g/) - [ProfiShark 10G+](https://www.profitap.com/profishark-10g-plus/)   [**Accessories**](https://www.profitap.com/accessories/) - [Transceivers](https://www.profitap.com/transceivers/) - [Data Diodes](https://www.profitap.com/data-diodes/) - [Connectivity](https://www.profitap.com/accessories/#connectivity/) [**Network Traffic Aggregators**](https://www.profitap.com/network-traffic-aggregators/) - [XX-720G](https://www.profitap.com/xx-720g-network-packet-broker/) - [XX-1800G](https://www.profitap.com/xx-1800g-network-packet-broker/) - [XX-3200G](https://www.profitap.com/xx-3200g-network-packet-broker/)   [**Network Packet Brokers**](https://www.profitap.com/network-packet-brokers/) - [X3-Series](https://www.profitap.com/x3-series-advanced-network-packet-brokers/) - [X2-2010G](https://www.profitap.com/x2-2010g-network-packet-broker/) - [X2-3200G](https://www.profitap.com/x2-3200g-network-packet-broker/) - [X2-6400G](https://www.profitap.com/x2-6400g-network-packet-broker/) - [X2-12800G](https://www.profitap.com/x2-12800g-network-packet-broker/)   **NPB Features** - [Data Masking](https://www.profitap.com/data-masking/) - [Timestamping](https://www.profitap.com/timestamping/) - [Packet Deduplication](https://www.profitap.com/packet-deduplication/) - [Tunneling & De-tunneling](https://www.profitap.com/tunneling-de-tunneling/) - [Packet Slicing](https://www.profitap.com/packet-slicing/) - [GTP IP Filtering](https://www.profitap.com/gtp-ip-filtering/) [**Network TAPs**](https://www.profitap.com/network-taps/) - [Secure TAPs](https://www.profitap.com/secure-data-access/) - [Fiber TAPs](https://www.profitap.com/fiber-taps/) - [Copper TAPs](https://www.profitap.com/copper-taps/) - [Aggregation TAPs](https://www.profitap.com/aggregation-taps/) - [Bypass TAPs](https://www.profitap.com/bypass-taps/) - [Regeneration TAPs](https://www.profitap.com/regeneration-taps/) - [Replication TAPs](https://www.profitap.com/replication-taps/)   **Cloud Visibility** - [VMware](https://www.profitap.com/vtap/) - [Kubernetes](https://www.profitap.com/cloud-tap/) - [AWS EKS](https://www.profitap.com/cloud-tap/) - [Azure VM](https://www.profitap.com/cloud-tap/#azure)   **Centralized Management** - [IOTA CM](https://www.profitap.com/iota-cm/) - [Supervisor](https://www.profitap.com/supervisor/)   [**Solutions**](https://www.profitap.com/solutions/) - [Performance analysis & diagnostics](https://www.profitap.com/performance-analysis-and-diagnostics-solutions/) - [Network troubleshooting](https://www.profitap.com/network-troubleshooting-solutions/) - [Packet forensics](https://www.profitap.com/packet-forensics-solutions/) - [Network security](https://www.profitap.com/network-security-solutions/) - [ICS/OT network monitoring](https://www.profitap.com/ics-ot-network-monitoring-solutions/) [**About Us**](https://www.profitap.com/our-story/) - [Our Story](https://www.profitap.com/our-story/) - [Events](https://www.profitap.com/events/) - [Careers](https://jobs.profitap.com/) - [News](https://news.profitap.com/)   **Resources** - [Knowledge Base](https://kb.profitap.com/) - [Software & Drivers](https://resources.profitap.com/) - [Product Portfolio](https://www.profitap.com/portfolio/) - [Blog](https://insights.profitap.com/) - [Library](https://www.profitap.com/library/) - [Product Updates](https://www.profitap.com/product-updates/) - [Academy](https://www.profitap.com/academy/)   **Partners** - [Partner with Us](https://www.profitap.com/partner-with-us/) - [Our Partners](https://www.profitap.com/our-partners/) - [Locate a Reseller](https://www.profitap.com/locate-a-reseller/)   **Contact** - [Contact Us](https://www.profitap.com/contact-us/) - [Professional Services](https://www.profitap.com/professional-services/) - [Get a Quote](https://www.profitap.com/get-a-quote/) --- © 2026 Profitap HQ B.V. and its licensors. All Rights Reserved — Profitap HQ B.V., High Tech Campus 84, 5656 AG Eindhoven, The Netherlands | [Privacy Policy](https://www.profitap.com/privacy-policy/) | [Terms and Conditions](https://www.profitap.com/terms-and-conditions/) ```json { "@context" : "http://schema.org", "@type" : "Blog", "author" : { "@type" : "Person", "name" : "Profitap" }, "dateModified" : "May 29, 2024, 11:54:59 AM", "datePublished" : "2024-04-22 13:19:31", "description" : "Discover essential Wireshark filters for efficient network analysis and troubleshooting. Learn how to capture actionable network data.", "headline" : "The best Wireshark filters for troubleshooting.", "image" : { "@type" : "ImageObject", "url" : "https://2954816.fs1.hubspotusercontent-na1.net/hubfs/2954816/Blank%20diagram%20%285%29.jpeg" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/2954816/Logos/Profitap-logo-black-orange-whitebg.png" }, "name" : "Profitap HQ B.V." } } ```