Free Tool
Wireshark Display Filter Cheatsheet
Comprehensive, searchable reference of 80+ Wireshark display filters organized by category. Find the right filter instantly, copy it, or build custom compound filters.
Build Custom Filter
Combine multiple display filters with logical operators. Click "Add Condition" to build compound filters visually.
Why Wireshark Display Filters Matter
Wireshark captures every packet on the wire, but without effective display filters you're looking at a firehose of data. Display filters let you isolate the exact traffic you need — whether you're debugging a slow application, investigating a security incident, or analyzing DDoS attack patterns.
Unlike capture filters (BPF syntax), display filters use Wireshark's own rich expression language and can reference any protocol field that Wireshark dissects. They're applied after capture, so you can refine your view without losing data.
Using Filters for DDoS Detection
Network engineers frequently use Wireshark to analyze DDoS attacks after the fact. Filters like tcp.flags.syn==1 && tcp.flags.ack==0 help identify SYN floods, while dns.qr==0 && udp.length>512 can reveal DNS amplification attempts.
For real-time detection rather than post-incident analysis, Flowtriq monitors your traffic continuously and detects DDoS attacks in under 1 second — before you even have time to open Wireshark.
Quick Reference Card
The 20 most essential Wireshark filters for DDoS analysis, organized by use case.
udp && frame.len < 100
icmp.type==8
dns.qry.type==255
ntp.priv.reqcode==42
tcp.port==80 || tcp.port==443
frame.len > 1400
tcp.analysis.retransmission
tcp.analysis.zero_window
udp.srcport==123 && frame.len > 468
udp.srcport==11211
udp.srcport==1900
udp.srcport==19
tcp.analysis.lost_segment
tcp.analysis.duplicate_ack
http.response.code >= 500
tcp.time_delta > 1
FAQ