Skip to main content

Filter Network Packets

Filters hide packets that are not relevant to the current question. They do not delete packets or change the capture file.

TCP Viewer has quick protocol filters for common checks and structured filters for exact rules. You can combine them with an app or domain selected in the sidebar.

Use quick protocol chips and structured rules to remove packet noise.

1. Benefits​

  • ✅ Focus on TCP, UDP, DNS, HTTP, TLS, WebSocket, or packet errors in one click.
  • ✅ Find TLS Client Hello and Server Hello packets quickly.
  • ✅ Match addresses, ports, domains, apps, stream IDs, flags, lengths, and more.
  • ✅ Combine up to five structured rows with AND or OR.
  • ✅ Use contains, prefix, suffix, number, and regular-expression conditions.
  • ✅ Save reusable custom filters with TCP Viewer PRO.

2. Use quick filters​

  1. Start a capture or open a capture file.
  2. Press Command-F or select Filter in the bottom status bar.
  3. Select one or more chips such as TCP, DNS, TLS, or Errors.
  4. Select a chip again to turn it off, or choose All to reset the quick filters.

When several quick filters are active, a packet can match any selected chip. For example, selecting DNS and TLS shows packets that match DNS or TLS.

3. Build a structured filter​

Each structured row contains a field, a condition, and a value.

  1. Open the filter area with Command-F.
  2. Choose a field such as URL/Domain, Protocol, Source, Destination, Source Port, Client, Stream ID, TCP Flags, or Length.
  3. Choose a condition such as Contains, Not Contains, Has Prefix, Match Regex, <, or >=.
  4. Enter the value.
  5. Use + to add another row. Adding more rows requires PRO.
  6. Choose AND all filters when every row must match, or OR all filters when any row may match.

Disable a row with its checkbox when you want to keep the rule but ignore it for a moment.

4. Save a custom filter​

With TCP Viewer PRO, select Save, give the group a clear name, and reuse it from the custom-filter area. You can rename, duplicate, override, or delete a saved filter later.

5. Display filter or capture filter?​

The filters in this page work on packets already collected by TCP Viewer. They are safe to change because hidden packets remain in the capture.

A BPF capture filter is different: it controls which future packets are collected, so nonmatching traffic is never added. TCP Viewer MCP may set a BPF filter only after explicit confirmation. Use a normal packet filter for most searches. See TCP Viewer MCP for details.