Skip to main content

Use Wireshark Display Filters in TCP Viewer

TCP Viewer can use Wireshark display-filter syntax to find packets. This is useful when you already know Wireshark filters or need a protocol field that is not available in the visual Filter Builder.

A display filter only hides packets from the table. It does not delete packets or change the capture file.

1. What Wireshark filters work with​

  • Common protocols such as TCP, UDP, DNS, HTTP, TLS, ICMP, ARP, and IPv6.
  • Addresses, ports, packet lengths, TCP flags, stream numbers, and protocol fields.
  • Text and byte searches with contains.
  • Text patterns with matches.
  • Rules joined with and, or, not, and parentheses.
  • Sets, ranges, field slices, and built-in functions supported by TCP Viewer's bundled Wireshark version.
  • Wireshark columns such as _ws.col.protocol and _ws.col.info.
  • Live captures, stopped live captures, PCAP files, and PCAPNG files.
  • TCP Viewer's quick filters and app, domain, or file selections in the sidebar.

2. How to use a Wireshark filter​

  1. Start a live capture or open a capture file.
  2. Select Filter ⌘F in the bottom status bar.
  3. Choose Wireshark Filter….
  4. Type or paste a display filter, such as tcp.port == 443.
  5. Select Apply.
  6. Wait for TCP Viewer to check the packets. Large captures may take a little longer.

TCP Viewer checks the expression before it changes the packet table. When a filter has an error, the app shows the column and selects the part that needs attention. The last working filter remains active.

To clear the filter, remove all text and select Apply again. Press Escape or use the close button to hide the filter area without clearing the applied filter.

3. Common Wireshark filter examples​

Protocols​

  • tcp shows TCP packets.
  • udp shows UDP packets.
  • dns shows DNS traffic.
  • http shows decoded HTTP traffic.
  • tls shows TLS traffic.
  • ipv6 and udp shows UDP packets carried over IPv6.
  • not arp and not icmp hides ARP and ICMP traffic.

IP addresses and ports​

  • ip.addr == 192.168.1.10 matches the address as either source or destination.
  • ip.src == 10.0.0.2 matches packets sent by one address.
  • ip.dst == 8.8.8.8 matches packets sent to one address.
  • tcp.port == 443 matches TCP traffic on port 443 in either direction.
  • udp.port == 53 matches DNS traffic that uses UDP port 53.
  • tcp.port in {80, 443, 8080} matches any listed TCP port.

HTTP, DNS, and TLS​

  • http.request.method == "GET" shows HTTP GET requests.
  • http.response.code >= 400 shows HTTP error responses.
  • http.host contains "example.com" searches HTTP host names.
  • dns.qry.name contains "example.com" searches DNS queries.
  • tls.handshake.extensions_server_name contains "example.com" searches TLS server names.
  • _ws.col.info contains "Client Hello" searches the Wireshark Info column.

TCP conversations and packet problems​

  • tcp.stream == 5 shows one TCP conversation by stream number.
  • tcp.analysis.retransmission shows TCP retransmissions.
  • tcp.flags.syn == 1 and tcp.flags.ack == 0 shows the first SYN packet of a TCP connection.
  • frame.len > 1000 shows packets larger than 1,000 bytes.
  • tcp.payload contains "GET" searches TCP payload bytes for text.

Combine more than one rule​

  • tcp.port == 443 and ip.addr == 192.168.1.10 matches HTTPS traffic for one address.
  • dns or tls shows packets that match either protocol.
  • (http or tls) and ip.dst == 10.0.0.5 groups rules before applying the destination check.

4. Save and reuse a filter​

With TCP Viewer PRO, select Save after a filter has been applied. You can:

  • Save the expression with a clear name.
  • Apply it again from the Wireshark filter list.
  • Rename or duplicate it.
  • Replace a saved Wireshark expression with a newer one.
  • Keep it in a TCP Viewer session file.

Saved Filter Builder rules and saved Wireshark filters stay separate, so updating one mode does not replace a filter from the other mode.

5. Display filter or capture filter?​

A Wireshark display filter checks packets that TCP Viewer has already collected. Hidden packets remain available and appear again when you clear the filter.

A BPF capture filter decides which future packets enter the capture. Packets that do not match a BPF filter are never collected. Use a display filter for normal investigation. Use a capture filter only when you know that the missing traffic will not be needed later.

6. Troubleshooting​

  • If the filter is red, read the message below the field and check the selected text.
  • If a valid filter finds nothing, confirm that the capture contains that protocol or field. For example, encrypted HTTPS content does not become an HTTP field unless it can be decoded.
  • If a field works in the Wireshark desktop app but not in TCP Viewer, it may come from a third-party Wireshark plugin. TCP Viewer uses its own bundled Wireshark fields.
  • Wireshark macros and selected-field tokens that start with $ are not supported. Write the full expression instead.
  • For the full language reference, read the Wireshark display-filter guide.