Port filter will make your analysis easy to show all packets to the selected port. The filter will be applied to the selected interface. In case there is no fixed port then system uses registered or public ports. Now we put “udp.dstport = 67 || udp.dstport = 68” as Wireshark filter and see only DHCP related packets.įor port filtering in Wireshark you should know the port number. When we run only UDP through Iperf we can see both source and destination ports are used from registered/public ports.ĥ. Now we put “tcp.port = 443” as Wireshark filter and see only HTTPS packets.

Now we put “udp.port = 53” as Wireshark filter and see only packets where port is 53.ģ. Here 192.168.1.6 is trying to send DNS query. Now we put “tcp.port = 80” as Wireshark filter and see only packets where port is 80.Ģ. Here 192.168.1.6 is trying to access web server where HTTP server is running. Ports 1024 to 49151 are Registered Ports.īefore we use filter in Wireshark we should know what port is used for which protocol.The figure below shows an issue on a home network. An Example should be: generally applicable and understandable (using common protocols, like HTTP, TCP, ) no repetition (provide something new) contain one (or two, but not more) special case(s) to explain the 'remaining' potential of the feature Example Filter Files. Heres a common example of how a Wireshark capture can assist in identifying a problem. In this article we will try to understand some well know ports through Wireshark analysis. Filtering: Wireshark is capable of slicing and dicing all of this random live data using filters.By applying a filter, you can obtain just the information you need to see.Common Wireshark Use Cases. To know more about filter by IP in Wireshark, please follow below link: If you’re interested in a packet with a particular IP address, type this into the filter bar: ip.adr x.x.x.x. Port filtering is the way of filtering packets based on port number. For example, this display filter will find all packets in the 129.111 Class-B network: ip.addr 129.111.0.0/16. There are several ways in which you can filter Wireshark by IP address: 1.

Wireshark https filter example