Complete Wireshark Filters commands reference — 82 commands across 2 categories. Quick reference cheat sheet for Windows, macOS & Linux.
| Shortcut | Action |
|---|---|
| ip.addr == 192.168.1.1 | IP filter |
| tcp.port == 443 | Port filter |
| http | HTTP filter |
| dns | DNS filter |
| tcp.flags.syn == 1 | SYN packets |
| frame.len > 1000 | Size filter |
| !(arp or dns) | Exclude filter |
| Shortcut | Action |
|---|---|
| wireshark -a --autostop | Specify a criterion that specifies when Wireshark is to stop writing to a capture file. |
| wireshark -b --ring-buffer | Cause Wireshark to run in "multiple files" mode. In "multiple files" mode, Wireshark will write |
| wireshark -B --buffer-size | Set capture buffer size (in MiB, default is 2 MiB). This is used by the capture driver |
| wireshark -c | Set the maximum number of packets to read when capturing live data. Acts the same as -a |
| wireshark -C | Start with the given configuration profile |
| wireshark --capture-comment | When performing a capture file from the command line, with the -k flag, add a capture comment |
| wireshark -D --list-interfaces | Print a list of the interfaces on which Wireshark can capture, and exit. For each network |
| wireshark --display | Specifies the X display to use. A hostname and screen (otherhost:0.0) or just a screen (:0.0) |
| wireshark -f | Set the capture filter expression. This option can occur multiple times. If used before |
| wireshark -F | When performing a capture file from the command line, with the -k option, set the file format |
| wireshark --fullscreen | Start Wireshark in full screen mode (kiosk mode). To exit from fullscreen mode, open the View |
| wireshark -g | After reading in a capture file using the -r flag, go to the given packet number |
| wireshark -h --help | Print the version number and options and exit |
| wireshark -i --interface - | Set the name of the network interface or pipe to use for live packet capture. Network interface |
| wireshark -I --monitor-mode | Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces |
| wireshark -j | Use after -J to change the behavior when no exact match is found for the filter. With this |
| wireshark -J | After reading in a capture file using the -r flag, jump to the packet matching the filter |
| wireshark -k | Start the capture session immediately. If the -i flag was specified, the capture uses |
| wireshark -l | Turn on automatic scrolling if the packet display is being updated automatically as packets |
| wireshark -L --list-data-link-types | List the data link types supported by the interface and exit |
| wireshark --list-time-stamp-types | List time stamp types supported for the interface. If no time stamp type can be set, no time |
| wireshark -o | Set a preference or recent value, overriding the default value and any value read |
| wireshark -p --no-promiscuous-mode | Don't put the interface into promiscuous mode. Note that the interface might be in promiscuous |
| wireshark -P | Special path settings usually detected automatically. This is used for special cases, e.g. |
| wireshark -r --read-file | Read packet data from infile, can be any supported capture file format |
| wireshark -R --read-filter | When reading a capture file specified with the -r flag, causes the specified filter |
| wireshark -s --snapshot-length | Set the default snapshot length to use when capturing live data. No more than snaplen bytes |
| wireshark --temp-dir | Specifies the directory into which temporary files (including capture files) are to be written. |
| wireshark --time-stamp-type | Change the interface's timestamp method. See --list-time-stamp-types |
| wireshark --update-interval | Set the length of time in milliseconds between new packet reports during a capture. Also sets |
| wireshark -v --version | Print the full version information and exit |
| wireshark -w | Set the default capture file name, or '-' for standard output |
| wireshark -X | Specify an option to be passed to an Wireshark module. The eXtension option is in the form |
| wireshark -y --linktype | If a capture is started from the command line with -k, set the data link type to use while |
| wireshark -Y --display-filter | Start with the given display filter |
| wireshark -z | Get Wireshark to collect various types of statistics and display the result in a window |
| wireshark -z help | Display all possible values for -z |
| wireshark -z afp,srt[,filter] | Show Apple Filing Protocol service response time statistics |
| wireshark -z conv,type[,filter] | Create a table that lists all conversations that could be seen in the capture. type specifies |
| wireshark -z dhcp,stat[,filter] | Show DHCP (BOOTP) statistics |
| wireshark -z expert | Show expert information |
| wireshark -z fc,srt[,filter] | Collect call/reply SRT (Service Response Time) data for FC. Data collected is the number |
| wireshark -z h225,counter[,filter] | Count ITU-T H.225 messages and their reasons. In the first column you get a list of H.225 |
| wireshark -z h225,srt[,filter] | Collect request/response SRT (Service Response Time) data for ITU-T H.225 RAS. Data collected |
| wireshark -z io,stat | Collect packet/bytes statistics for the capture in intervals of 1 second. This option will open |
| wireshark -z ldap,srt[,filter] | Collect call/reply SRT (Service Response Time) data for LDAP. Data collected is the number |
| wireshark -z megaco,srt[,filter] | Collect request/response SRT (Service Response Time) data for MEGACO. |
| wireshark -z mgcp,srt[,filter] | Collect request/response SRT (Service Response Time) data for MGCP. |
| wireshark -z mtp3,msus[,] | Show MTP3 MSU statistics |
| wireshark -z multicast,stat[,] | Show UDP multicast stream statistics |
| wireshark -z rpc,programs | Collect call/reply SRT data for all known ONC-RPC programs/versions. Data collected |
| wireshark -z scsi,srt,cmdset[,] | Collect call/reply SRT (Service Response Time) data for SCSI commandset <cmdset>. Commandsets |
| wireshark -z sip,stat[,filter] | This option will activate a counter for SIP messages. You will get the number of occurrences |
| wireshark -z smb,srt[,filter] | Collect call/reply SRT (Service Response Time) data for SMB. Data collected is the number |
| wireshark -z voip,calls | This option will show a window that shows VoIP calls found in the capture file. This |
| wireshark -z wlan,stat[,] | Show IEEE 802.11 network and station statistics |
| wireshark -z wsp,stat[,] | Show WSP packet counters |
| wireshark -d | Like Wireshark's Decode As... feature, this lets you specify how a layer type should be |
| wireshark --disable-all-protocols | Disable dissection of all protocols |
| wireshark --disable-protocol[,,...] | Disable dissection of proto_name. Use a proto_name of ALL to override your chosen profile's |
| wireshark --disable-heuristic | Disable dissection of heuristic protocol |
| wireshark --enable-protocol[,,...] | Enable dissection of proto_name. Use a proto_name of ALL to override your chosen profile's |
| wireshark --enable-heuristic | Enable dissection of heuristic protocol |
| wireshark -K | Load kerberos crypto keys from the specified keytab file. This option can be used multiple |
| wireshark -n | Disable network object name resolution (such as hostname, TCP and UDP port names); the -N |
| wireshark -N | Turn on name resolving only for particular types of addresses and port numbers, with name |
| wireshark --only-protocols | Only enable dissection of these protocols, comma separated. Disable everything else |
| wireshark -u | Specifies how packet timestamp formats in -t which are relative times |
| wireshark --log-level | Set the active log level. Supported levels in lowest to highest order are "noisy", "debug" |
| wireshark --log-fatal | Abort the program if any messages are logged at the specified level or higher. For example |
| wireshark --log-domains | Only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". List of domains |
| wireshark --log-debug | Force the specified domains to log at the "debug" level. List of domains must be |
| wireshark --log-noisy | Force the specified domains to log at the "noisy" level. List of domains must be |
| wireshark --log-fatal-domains | Abort the program if any messages are logged for the specified log domains. List of domains |
| wireshark --log-file | Write log messages and stderr output to the specified file |
Open your assistant with this page preloaded as the source — great for follow-up questions like "which of these work in other apps?"