Save only relevant traffic (5 packets) and exclude the unwanted traffic (397 packets).

Number2 - relevant number of packets on interface of Step-4 : save packets Number1- total number of packets captured on interface You can also edit the existing Capture Filter choices when clicking that button. Or you can select the Capture Filter button and choose from the precompiled list. Instead of “http contains “Google”” please Enter “ip.addr = 104.26.11.240” without double quotes.Īnd hit the enter key, your red filter Colour become green & you can see at the bottom If you already know your filter topic, you can just type in the area noted by the red box. In your case, open cmd prompt (windows user) and Nslookup your URL to find the ip address To apply correct filter, you should know the public IP address or port (or both). The master list of display filter protocol fields can be found in the display filter reference. The basics and the syntax of the display filters are described in the User's Guide. (Refer below video for detail information: Wireshark uses display filters for general packet filtering while viewing and for its ColoringRules. There is a difference between the syntax of the two and in the way they are.

Note that straight line next to interface means no active traffic on that interface. Wireshark has two filtering languages: capture filters and display filters. If you are confused with many options, please remove unwanted connected devices to reduce the options, also open any YouTube video so that you can see the traffic fluctuation on your internet link interface. Wiresharks most powerful feature is its vast array of display filters (over 285000 fields in 3000 protocols as of version 4.0.0). If you are using wireless router to connect internet, then select the Wi-fi: en0 option. You need to choose the interface you're sniffing data from.

Wireshark display filter syntax