Problem:
How can I filter using Wireshark?
Solution:
This will filter for any IP address
ip.addr == 10.20.5.10
This will filter for a TCP port
tcp.port == 1515
This will filter for an IP address and a TCP port
ip.addr == 10.110.246.6 and tcp.port == 1515
This will filter for an IP address and two ports you dont want to see
ip.addr == 10.134.247.6 and tcp.port not in {1515, 25}
This will filter for an http host name
http.host == "vm03"
This will filter for the broadcast address
eth.addr == ff:ff:ff:ff:ff:ff
This will filter for the destination port
tcp.dstport == 1515
This will filter out everything with the below IP
!(ip.addr == 10.143.247.6)
Some more information and examples
Default Columns
Logical Operators
Filtering Packets
Filter Types
Filter Syntax
Main Toolbar
Keyboard Shortcuts
Protocols
Capture modes