User Guide

Working with captured packets
105
Figure 6.6. Filtering on the TCP protocol
As you might have noticed, only packets of the TCP protocol are displayed now (e.g. packets 1-10 are
hidden). The packet numbering will remain as before, so the first packet shown is now packet number 11.
Note!
When using a display filter, all packets remain in the capture file. The display filter only
changes the display of the capture file but not its content!
You can filter on any protocol that Wireshark understands. You can also filter on any field that a dissector
adds to the tree view, but only if the dissector has added an abbreviation for the field. A list of such fields
is available in Wireshark in the Add Expression... dialog box. You can find more information on the Add
Expression... dialog box in Section 6.5, “The "Filter Expression" dialog box”.
For example, to narrow the packet list pane down to only those packets to or from the IP address
192.168.0.1, use ip.addr==192.168.0.1.
Note!
To remove the filter, click on the Clear button to the right of the filter field.
6.4. Building display filter expressions
Wireshark provides a simple but powerful display filter language that allows you to build quite complex
filter expressions. You can compare values in packets as well as combine expressions into more specific
expressions. The following sections provide more information on doing this.