wireshark display filter for specific source port

If you for some weird reason only want to see ICMP traffic then just use filter:Īnd if you want to see everything else but not ICMP traffic filter will of course be: If you want to filter UDP ports just use udp.port instead of tcp.port and so on If we want to see all traffic but not which use TCP port 22 we use this kind of filter: So if we want to see all traffic what comes from IP 192.168.0.206 and goes to TCP port 22 filter will look like this: Or all traffic which comes from TCP port 22: If we want to see all traffic which goes to TCP port 22 we can use filter like this: Of course we can combine all of these so if we example want to see TCP port 22 traffic from a device which MAC-address is 00:11:22:33:44:55 we can use this kind of filter:Įth.addr = 00:11:22:33:44:55 & tcp.port 22

If we want to filter everything with MAC-address 00:11:22:33:44:55 we can use filter like this: So you have to use & when you want to combine two or more parameters(?) If we only want to see all traffic on port 80 from/to our computer we can combine two filter together and use: Let’s say we want to see all traffic on port 80:

Sometimes we only want to see traffic from specific port. If we want to see everything what has something to do with our computer we can use this kind of filter:

This will filter out everything what has something to do with IP 192.168.0.206 Sometimes we want to see everything but not the traffic what comes from our own computer (let’s say that our computer IP is 192.168.0.206): If we want to see everything which source IP is 192.168.0.205 we can use this kind of filter (src = source):Īnd if we want to see everything which destination IP is 192.168.0.205 we can use this kind of filter (dst = destination):

Wireshark display filter for specific source port