DisplayFilters
Wireshark uses display filters for general packet filtering while viewing and for its ColoringRules.
The basics and the syntax of the display filters are described in the User’s Guide.
The master list of display filter protocol fields can be found in the display filter reference.
If you need a display filter for a specific protocol, have a look for it at the ProtocolReference.
Examples
Show only SMTP (port 25) and ICMP traffic:
-
tcp.port eq 25 or icmp
Show only traffic in the LAN (192.168.x.x), between workstations and servers — no Internet:
-
ip.src==192.168.0.0/16 and ip.dst==192.168.0.0/16