W ireshar k Cheat S heet
De fault column s in a packe t cap ture output
No.
Time
S o u r c e (s r c)
D e s t i n a t i o n (d s t)
Protocol
Length
F r a m e n u m b e r f r o m t h e b e g i n i n g o f t h e p a c ke t c a p t u r e
Seconds from the first frame
Source address, commonly an IP v4, IP v6 or Ethernet address
Destination adress
P r o t o c o l u s e d i n t h e E t h e r n e t f r a m e , I P p a c ke t , o r TC s e g m e n t
Leng th of the frame in by tes
Log ic al op e rator s
Operator
Discription
Example
and or &&
Logical AND
All the conditions should match
o r o r ||
Logical OR
Either all or one of the condtions should match
xor or ^ ^
Logical XOR
E xclusi ve alterations - onl y one of the t wo
conditions should match not both
N o t ( N e g a t i o n)
Not equal to
Substring operator
Filter a specific word or tex t
not ot !
[ n ]
[ ... ]
Filte ring packe t s (Di s p lay Filte r s)
Operator
Discription
Example
eq or = =
Equal
ne or !=
Not equal
gt or >
Greater than
it or <
ge or >=
less than
Greater than or equal
frame.len >=
10
le or <=
Less than or equal
frame.len <=
10
i p . d e s t = = 19 2 .16 8 .1.1
ip.des t !=
19 2 .16 8 .1.1
frame.len
>
10
frame.len <
10
Filte r t y p e s
Capture filter
F i l t e r p a c ke t s d u r i n g c a p t u r e
Display filter
H i d e p a c ke t s f r o m a c a p t u r e d i s p l a y
W ire shark Capturing Mo de s
Promiscuous
mode
Monitor
mode
Mi s ce llane ou s
S e t s i n t e r f a c e t o c a p t u r e a l l p a c ke t s
on a net work segment to which it is associated to
Setup the wirless inter face to capture
all traffic it can receive (Unix / Linux only)
Slice Operator
[ ... ] - Range of values
Membership Operator
{} - In
C T R L+ E
Star t /Stop Capturing
C apture Filte r S y nt a x
Syntax
Example
protocol Direction
hosts
tcp
src
19 2 .16 8 .1.1
value
80
Logical operator
and
Expressions
t c p d s t 2 0 2 .16 4 . 3 0 .1
Di s play Filte r S y nt a x
Syntax
protocol
String 1
String 2
Example
ht tp
dest
ip
CompariSon
Operator
Va l u e
Logical
Operator
Expressions
==
19 2 .16 8 .1.1
and
tcp por t
Key b oard S hor tcut s - main di sp lay w indow
Accelerator
Ta b o r
S h i f t +Ta b
Description
Alt+
or
Optio
or F8
Ct r l +
Or F7
C t r l +.
C t r l +,
M o v e t o t h e p r e v i o u s p a c ke t o r d e t a i l
item.
M o v e t o t h e n e x t p a c ke t , e v e n
i f t h e p a c ke t l i s t i s n ' t f o c u s e d .
M o v e t o t h e p r e v i o u s p a c ke t ,
e v e n i f t h e p a c ke t l i s t i s n ' t f o c u s e d .
M o v e t o t h e n e x t p a c ke t o f t h e
c o n v e r s a t i o n ( TC P, U D P o r I P ) .
M o v e t o t h e p r e v i o u s p a c ke t o f
t h e c o n v e r s a t i o n ( TC P, U D P o r I P ) .
M o v e t o t h e n e x t p a c ke t
i n t h e s e l e c t i o n h i s t o r y.
I n t h e p a c ke t d e t a i l , o p e n s t h e s e l e c t e d t r e e i t e m .
M o v e t o t h e n e x t p a c ke t o r d e t a i l i t e m .
Ctrl+
Description
Accelerator
Move bet ween screen
elements, e.g. from the toolbars
t o t h e p a c ke t l i s t t o t h e p a c ke t d e t a i l .
Shif t+
I n t h e p a c ke t d e t a i l , o p e n s t h e s e l e c t e d
tree items and all of its subtrees.
Ctrl+
I n t h e p a c ke t d e t a i l , o p e n s a l l t r e e i t e m s .
Ct r l +
I n t h e p a c ke t d e t a i l , c l o s e s a l l t h e t r e e
Backspace
I n t h e p a c ke t d e t a i l , j u m p s t o t h e p a r e n t n o d e .
Return
or Enter
I n t h e p a c ke t d e t a i l , t o g g l e s t h e s e l e c t e d t r e e i t e m .
Proto col s - Value s
e t h e r, f d d i , i p , a r p , r a r p , d e c n e t , l a t , s c a , m o p r c , m o p d l , t c p a n d u d p
W ires hark Cheat S heet
Common Filte ring command s
Usage
Wireshark Filter by IP
Filter by Destination IP
Filter by Source IP
Filter by IP range
Filter by Multiple Ips
Filter out IP adress
Filter subnet
Filter by port
Filter by destination port
Filter by ip adress and port
Filter by URL
Filter by time stamp
Filter S YN flag
Wireshark Beacon Filter
Wireshark broadcast filter
Wireshark multicast filter
Host name filter
MAC address filter
R ST flag filter
Filter syntax
i p . a d d = = 10 .10 . 5 0 .1
i p . d e s t = = 10 .10 . 5 0 .1
i p . s r c = = 10 .10 . 5 0 .1
i p . a d d r > = 10 .10 . 5 0 .1 a n d i p . a d d r < =10 .10 . 5 0 .10 0
i p . a d d r = = 10 .10 . 5 0 .1 a n d i p . a d d r = = 10 .10 . 5 0 .10 0
! ( i p . a d d r = = 10 .10 . 5 0 .1)
i p . a d d r = = 10 .10 . 5 0 .1/ 2 4
tcp.por t == 25
tcp.ds tpor t == 23
i p . a d d r = = 10 .10 . 5 0 .1 a n d Tc p . p o r t = = 2 5
ht tp.hos t == "hos t name"
f r a m e . t i m e > = " J u n e 0 2 , 2 019 18 : 0 4 : 0 0 "
Tc p .fl a g s . s y n = = 1
Tc p .fl a g s . s y n = = 1 a n d t c p .fl a g s . a c k = = 0
wlan.fc.t ype_ subt ype = 0x08
e t h . d s t == ff : ff : ff : ff : ff : ff
(e t h . d s t [ 0 ] & 1)
ip.hos t = hos tname
e t h . a d d r = = 0 0 :7 0 : f4 : 2 3 :18 :c 4
t c p .fl a g . r e s e t = = 1
Common Filte ring command s
To o l b a r I c o n To o l b a r I t e m
Start
Menu Item
Capture
Star t
Description
U s e s t h e s a m e p a c ke t c a p t u r i n g o p t i o n s a s
the previous session,or uses defaults if no
options were set
Capture
Stops currently ac tive capture
Stop
Capture
Restar t ac tive capture session
Restart
Restar t
Capture
O p e n s " C a p t u r e O p t i o n s " d i a l o g b ox
Options...
Optio...
File
O p e n s " F i l e o p e n " d i a l o g b ox
Open...
Open...
to load a capture for viewing
File
Save current capture file
Save A s. . .
Save A s...
File
Close current capture file
Close
Close
File
Reload current capture file
Reload
Reload
F i n d p a c ke t b a s e d o n d i ff e r e n t c r i t e r i a
F i n d P a c ke t . . . E d i t
F i n d P a c ke t . . .
Go
J u m p b a c k i n t h e p a c ke t h i s t o r y
Go back
Go back
Go
J u m p f o r w a r d i n t h e p a c ke t h i s t o r y
Go For ward
Go For ward
Go
G o t o s p e c i fi c p a c ke t
G o t o P a c ke t . . .
G o t o P a c ke t . . .
Go to First
Go
J u m p t o fi r s t p a c ke t o f t h e c a p t u r e fi l e
P a c ke t
G o t o F i r s t P a c ke t
Go to Last
Go
J u m p t o l a s t p a c ke t o f t h e c a p t u r e fi l e
P a c ke t
G o t o L a s t P a c ke t
Auto Scroll in View Auto Scroll
A u t o s c r o l l p a c ke t l i s t d u r i n g l i v e c a p t u r e
Live Capture
in Live Capture
View
C o l o r i z e t h e p a c ke t l i s t (o r n o t )
Colorize
Colorize
Z o o m i n t o t h e p a c ke t d a t a
View
Zoom In
( i n c r e a s e t h e f o n t s i z e)
Zoom In
Z
o
o
m o u t o f t h e p a c ke t d a t a
V
i
e
w
Zoom Out
(d e c r e a s e t h e f o n t s i z e)
Zoom Out
View
Normal Size
S e t z o o m l e v e l b a c k t o 10 0 %
Normal Size
Resize Columns View
Resize columns, so the content fit s the width
Resize Columns
Stop
Find more StationX Cheat Sheets here https://www.stationx.net/category/cheat-sheets/