Wireshark Filters for Penetration Testing

Common Wireshark display filters for isolating traffic during pentests.

Wireshark’s display filter bar is where most of the time savings live. Here are the filters I reach for most often when triaging a capture.

1
ip.src == 192.168.1.1          # Show only packets originating from this IP
2
ip.dst == 192.168.1.1          # Show only packets destined for this IP
3
tcp.port == 22                 # Show only traffic on TCP port 22
4
udp.port == 67                 # Show only traffic on UDP port 67
5
http.request.method == GET     # Show only HTTP GET requests
6
http.request.method == POST    # Show only HTTP POST requests