# WireShark filters

<table><thead><tr><th width="229">Filter</th><th width="314">Function</th></tr></thead><tbody><tr><td><code>ip.addr</code></td><td>Lists packets with IP address of specified value</td></tr><tr><td><code>ip.dst</code></td><td>Lists packets with destination IP address of specified value</td></tr><tr><td><code>ip.src</code></td><td>Lists packets with source address IP of specified value</td></tr><tr><td><code>tcp.port</code></td><td>Lists packets with TCP ports of specified value</td></tr><tr><td>udp.port</td><td>Lists packets with UDP ports of specified value</td></tr><tr><td><code>http.request</code></td><td>Filters all HTTP GET and POST requests</td></tr><tr><td><code>http.response</code></td><td>Shows the responses to the HTTP requests, including the response codes</td></tr><tr><td><code>dns</code></td><td>Sets a filter to display all packets that contain DNS data</td></tr><tr><td><code>tcp contains</code></td><td>Displays all TCP packets that contain a string matching whatever is defined as</td></tr><tr><td><code>ip.addr == 10.0.0.1</code></td><td>Show any packet with Specific IP (example 10.0.01)</td></tr><tr><td><code>tcp.port==22</code></td><td>how any TCP packet with Specific Port (example port 22)</td></tr><tr><td><p>Class A</p><p><code>ip.addr == 10.0.0.0/8</code></p><p>Class B</p><p><code>ip.addr == 10.10.0.0/16</code></p><p>Class C</p><p><code>ip.addr == 10.10.10.0/24</code></p></td><td>Show packets to and from any address in a subnet</td></tr><tr><td><code>tcp.dstport == 80</code></td><td>Show all protocol traffic (example HTTP port 80)</td></tr><tr><td><code>tcp.port == 80 and ip.addr == 10.0.0.1</code></td><td>Show specific traffic to/from specific IP address (HTTP on example 10.0.0.1 )</td></tr><tr><td><code>http.request.method == “POST”</code></td><td>Filter for HTTP POST Requests</td></tr><tr><td><code>http.request.method == “GET”</code></td><td>Filter for HTTP GET Requests</td></tr><tr><td><code>http.response.code == 200</code></td><td>Show specific response request (example 200)</td></tr><tr><td><code>frame contains traffic</code></td><td>Show all packets that contain the word ‘traffic’</td></tr></tbody></table>