Free Tool
Wireshark Display Filter Cheatsheet
Comprehensive, searchable reference of 80+ Wireshark display filters organized by category. Find the right filter instantly, copy it, or build custom compound filters.
Build Custom Filter
Combine multiple display filters with logical operators. Click "Add Condition" to build compound filters visually.
Click "Add Condition" to start building
Why Wireshark Display Filters Matter
Wireshark captures every packet on the wire, but without effective display filters you're looking at a firehose of data. Display filters let you isolate the exact traffic you need -- whether you're debugging a slow application, investigating a security incident, or analyzing DDoS attack patterns.
Unlike capture filters (BPF syntax), display filters use Wireshark's own rich expression language and can reference any protocol field that Wireshark dissects. They're applied after capture, so you can refine your view without losing data.
Using Filters for DDoS Detection
Network engineers frequently use Wireshark to analyze DDoS attacks after the fact. Filters like tcp.flags.syn==1 && tcp.flags.ack==0 help identify SYN floods, while dns.qr==0 && udp.length>512 can reveal DNS amplification attempts.
For real-time detection rather than post-incident analysis, Flowtriq monitors your traffic continuously and detects DDoS attacks in under 1 second -- before you even have time to open Wireshark.