Complete Wireshark Filters commands reference — 82 commands across 2 categories. Quick reference cheat sheet for Windows, macOS & Linux.
This page has two very different halves. The display filters at the top are the syntax you type into the filter bar to narrow a capture, and they are what most people mean by "Wireshark shortcuts". The command-line options below them come from the wireshark binary's manual and matter when you start captures from scripts or remote shells rather than the GUI.
| Shortcut | Action |
|---|---|
| ip.addr == 192.168.1.1 | IP filter |
| tcp.port == 443 | Port filter |
| http | HTTP filter |
| dns | DNS filter |
| tcp.flags.syn == 1 | SYN packets |
| frame.len > 1000 | Size filter |
| !(arp or dns) | Exclude filter |
| Shortcut | Action |
|---|---|
| wireshark -a --autostop | Specify a criterion that specifies when Wireshark is to stop writing to a capture file. |
| wireshark -b --ring-buffer | Cause Wireshark to run in "multiple files" mode. In "multiple files" mode, Wireshark will write |
| wireshark -B --buffer-size | Set capture buffer size (in MiB, default is 2 MiB). This is used by the capture driver |
| wireshark -c | Set the maximum number of packets to read when capturing live data. Acts the same as -a |
| wireshark -C | Start with the given configuration profile |
| wireshark --capture-comment | When performing a capture file from the command line, with the -k flag, add a capture comment |
| wireshark -D --list-interfaces | Print a list of the interfaces on which Wireshark can capture, and exit. For each network |
| wireshark --display | Specifies the X display to use. A hostname and screen (otherhost:0.0) or just a screen (:0.0) |
| wireshark -f | Set the capture filter expression. This option can occur multiple times. If used before |
| wireshark -F | When performing a capture file from the command line, with the -k option, set the file format |
| wireshark --fullscreen | Start Wireshark in full screen mode (kiosk mode). To exit from fullscreen mode, open the View |
| wireshark -g | After reading in a capture file using the -r flag, go to the given packet number |
| wireshark -h --help | Print the version number and options and exit |
| wireshark -i --interface - | Set the name of the network interface or pipe to use for live packet capture. Network interface |
| wireshark -I --monitor-mode | Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces |
| wireshark -j | Use after -J to change the behavior when no exact match is found for the filter. With this |
| wireshark -J | After reading in a capture file using the -r flag, jump to the packet matching the filter |
| wireshark -k | Start the capture session immediately. If the -i flag was specified, the capture uses |
| wireshark -l | Turn on automatic scrolling if the packet display is being updated automatically as packets |
| wireshark -L --list-data-link-types | List the data link types supported by the interface and exit |
| wireshark --list-time-stamp-types | List time stamp types supported for the interface. If no time stamp type can be set, no time |
| wireshark -o | Set a preference or recent value, overriding the default value and any value read |
| wireshark -p --no-promiscuous-mode | Don't put the interface into promiscuous mode. Note that the interface might be in promiscuous |
| wireshark -P | Special path settings usually detected automatically. This is used for special cases, e.g. |
| wireshark -r --read-file | Read packet data from infile, can be any supported capture file format |
| wireshark -R --read-filter | When reading a capture file specified with the -r flag, causes the specified filter |
| wireshark -s --snapshot-length | Set the default snapshot length to use when capturing live data. No more than snaplen bytes |
| wireshark --temp-dir | Specifies the directory into which temporary files (including capture files) are to be written. |
| wireshark --time-stamp-type | Change the interface's timestamp method. See --list-time-stamp-types |
| wireshark --update-interval | Set the length of time in milliseconds between new packet reports during a capture. Also sets |
| wireshark -v --version | Print the full version information and exit |
| wireshark -w | Set the default capture file name, or '-' for standard output |
| wireshark -X | Specify an option to be passed to an Wireshark module. The eXtension option is in the form |
| wireshark -y --linktype | If a capture is started from the command line with -k, set the data link type to use while |
| wireshark -Y --display-filter | Start with the given display filter |
| wireshark -z | Get Wireshark to collect various types of statistics and display the result in a window |
| wireshark -z help | Display all possible values for -z |
| wireshark -z afp,srt[,filter] | Show Apple Filing Protocol service response time statistics |
| wireshark -z conv,type[,filter] | Create a table that lists all conversations that could be seen in the capture. type specifies |
| wireshark -z dhcp,stat[,filter] | Show DHCP (BOOTP) statistics |
| wireshark -z expert | Show expert information |
| wireshark -z fc,srt[,filter] | Collect call/reply SRT (Service Response Time) data for FC. Data collected is the number |
| wireshark -z h225,counter[,filter] | Count ITU-T H.225 messages and their reasons. In the first column you get a list of H.225 |
| wireshark -z h225,srt[,filter] | Collect request/response SRT (Service Response Time) data for ITU-T H.225 RAS. Data collected |
| wireshark -z io,stat | Collect packet/bytes statistics for the capture in intervals of 1 second. This option will open |
| wireshark -z ldap,srt[,filter] | Collect call/reply SRT (Service Response Time) data for LDAP. Data collected is the number |
| wireshark -z megaco,srt[,filter] | Collect request/response SRT (Service Response Time) data for MEGACO. |
| wireshark -z mgcp,srt[,filter] | Collect request/response SRT (Service Response Time) data for MGCP. |
| wireshark -z mtp3,msus[,] | Show MTP3 MSU statistics |
| wireshark -z multicast,stat[,] | Show UDP multicast stream statistics |
| wireshark -z rpc,programs | Collect call/reply SRT data for all known ONC-RPC programs/versions. Data collected |
| wireshark -z scsi,srt,cmdset[,] | Collect call/reply SRT (Service Response Time) data for SCSI commandset <cmdset>. Commandsets |
| wireshark -z sip,stat[,filter] | This option will activate a counter for SIP messages. You will get the number of occurrences |
| wireshark -z smb,srt[,filter] | Collect call/reply SRT (Service Response Time) data for SMB. Data collected is the number |
| wireshark -z voip,calls | This option will show a window that shows VoIP calls found in the capture file. This |
| wireshark -z wlan,stat[,] | Show IEEE 802.11 network and station statistics |
| wireshark -z wsp,stat[,] | Show WSP packet counters |
| wireshark -d | Like Wireshark's Decode As... feature, this lets you specify how a layer type should be |
| wireshark --disable-all-protocols | Disable dissection of all protocols |
| wireshark --disable-protocol[,,...] | Disable dissection of proto_name. Use a proto_name of ALL to override your chosen profile's |
| wireshark --disable-heuristic | Disable dissection of heuristic protocol |
| wireshark --enable-protocol[,,...] | Enable dissection of proto_name. Use a proto_name of ALL to override your chosen profile's |
| wireshark --enable-heuristic | Enable dissection of heuristic protocol |
| wireshark -K | Load kerberos crypto keys from the specified keytab file. This option can be used multiple |
| wireshark -n | Disable network object name resolution (such as hostname, TCP and UDP port names); the -N |
| wireshark -N | Turn on name resolving only for particular types of addresses and port numbers, with name |
| wireshark --only-protocols | Only enable dissection of these protocols, comma separated. Disable everything else |
| wireshark -u | Specifies how packet timestamp formats in -t which are relative times |
| wireshark --log-level | Set the active log level. Supported levels in lowest to highest order are "noisy", "debug" |
| wireshark --log-fatal | Abort the program if any messages are logged at the specified level or higher. For example |
| wireshark --log-domains | Only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". List of domains |
| wireshark --log-debug | Force the specified domains to log at the "debug" level. List of domains must be |
| wireshark --log-noisy | Force the specified domains to log at the "noisy" level. List of domains must be |
| wireshark --log-fatal-domains | Abort the program if any messages are logged for the specified log domains. List of domains |
| wireshark --log-file | Write log messages and stderr output to the specified file |
ip.addr == 192.168.1.1 matches packets to or from a host — use ip.src or ip.dst when direction matters. tcp.port == 443 isolates a service, and protocol names alone, such as http or dns, select every packet the dissector recognises as that protocol. tcp.flags.syn == 1 shows connection attempts, which is the fastest way to see whether a client is even reaching a server; add and tcp.flags.ack == 0 to keep only the initial SYNs. frame.len > 1000 finds large frames, and !(arp or dns) is the usual first filter on a noisy LAN capture. Display filters are not capture filters: they hide packets already captured, and the syntax differs from the BPF used by -f.
wireshark -D --list-interfaces prints the interfaces Wireshark can see, and wireshark -i --interface - picks one — or a pipe — for a live capture. wireshark -k starts capturing immediately instead of waiting for a click, and wireshark -f applies a capture filter in BPF syntax so only matching packets are written. For long-running captures, wireshark -b --ring-buffer rotates files and wireshark -a --autostop stops after a duration, size or packet count, which prevents a forgotten capture from filling a disk.
wireshark -g opens a capture at a given packet number and wireshark -J jumps to the first packet matching a display filter — with wireshark -j adjusting what happens when nothing matches exactly. wireshark -C starts with a named configuration profile, useful when you keep separate colouring rules for different networks. For anything non-interactive, the companion tshark binary accepts the same core options and prints to standard output.
Display filters (typed in the filter bar) hide packets already captured and use Wireshark syntax. Capture filters (-f) decide what is recorded and use BPF syntax like tcpdump.
Filter on SYNs without a matching SYN-ACK: tcp.flags.syn == 1 and tcp.flags.ack == 0, then look for hosts with repeated entries.
Use -b for a ring buffer of rotating files, or -a with a duration or filesize limit.
Use tshark, the terminal version, which shares the capture and filter options and writes to stdout.
Open your assistant with this page preloaded as the source — great for follow-up questions like "which of these work in other apps?"