Thread: Filtering In Wireshark

There is way too much data that Wireshark churns up when you set it to capture data. It is close to impossible to use all of that data. The filter feature is one of the most important things to understand in Wireshark, as it will make going through connections and packets much simpler than if you were to do it one packet at a time.

The simplest way to filter data is to use the Filter toolbar. Use keywords like tcp or udp to filter out data. More advanced parameters can be found by clicking on Expression. Scroll down to the category you want to filter. Expand the item and choose the parameter. Select a relation and enter a value. Click OK and the filter will be entered. A history of filters is stored in the same dropdown