Wireshark Cheat Sheet
Network protocol analyzer for deep packet inspection. Covers display filters by protocol, statistics features, stream following, and tshark CLI equivalents for automation.
TCP/IP Display Filters
Show all traffic to or from a specific IP address
$ ip.addr == 192.168.1.1Filter TCP port 443 traffic from a specific source IP
$ tcp.port == 443 && ip.src == 10.0.0.1Show only TCP SYN packets (new connection attempts)
$ tcp.flags.syn == 1 && tcp.flags.ack == 0Display only TCP retransmissions to identify network issues
$ tcp.analysis.retransmissionShow subnet traffic excluding ARP broadcasts
$ ip.addr == 192.168.1.0/24 && not arpApplication Protocol Filters
Show only HTTP POST requests
$ http.request.method == "POST"Filter DNS queries for a specific domain
$ dns.qry.name contains "target.com"Filter TLS traffic by SNI hostname
$ tls.handshake.extensions_server_name contains "target"Show HTTP error responses (4xx and 5xx)
$ http.response.code >= 400Display all email protocol traffic
$ smtp || pop || imapStatistics & Analysis
View all TCP conversations sorted by bytes transferred
$ Statistics > Conversations > TCPSee protocol distribution breakdown of the capture
$ Statistics > Protocol HierarchyList all IPv4 endpoints with packet and byte counts
$ Statistics > Endpoints > IPv4Summarize all HTTP requests by host and URI
$ Statistics > HTTP > RequestsReview warnings, errors, and anomalies detected in the capture
$ Analyze > Expert InformationFollowing Streams
Reconstruct and view the full TCP conversation
$ Right-click packet > Follow > TCP StreamView complete HTTP request/response exchanges
$ Right-click packet > Follow > HTTP StreamView decrypted TLS stream (requires key log file)
$ Right-click packet > Follow > TLS StreamFilter to display only TCP stream index 5
$ tcp.stream eq 5tshark CLI
Capture on eth0 for 60 seconds and save to pcap
$ tshark -i eth0 -w capture.pcap -a duration:60Extract HTTP hosts and URIs from a capture file
$ tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uriDisplay I/O statistics in 30-second intervals
$ tshark -r capture.pcap -qz io,stat,30Export DNS packets as JSON for analysis
$ tshark -r capture.pcap -Y "dns" -T json > dns_queries.jsonList all TCP conversations from a capture file
$ tshark -r capture.pcap -qz conv,tcp