AliZeroTrust
All tools / Wireshark Display Filter Builder
Packet analysis · Wireshark

Wireshark Display Filter Builder

Focus on the packets you need. Build a display filter from addresses, ports, and protocols without writing the expression by hand.

IPv4 & IPv6Both directionsBrowser-only processing

Traffic criteria

Optional. IPs or CIDRs; separate entries with commas or new lines.

Entries within a field are joined with OR. Different fields use AND.

Numbers or ranges, separated by commas.

Ports 0–65535. Both directions swaps address and port roles together.

Exclude packets involving these addresses at either endpoint.

Start with an example · replaces current criteria

Your display filter

This is a display filter, not a capture filter. It changes which captured packets are shown; it does not limit what is captured.

How to use your filter

  1. Choose a protocol and enter any addresses or ports you want to match.
  2. Select both directions to include responses. CIDRs are normalized to their network address.
  3. Copy the expression into the display filter bar above Wireshark’s packet list and press Enter.

Protocol filters depend on Wireshark recognizing that protocol. TLS filters show dissected TLS packets, not all traffic on port 443. This tool validates your inputs; Wireshark performs final expression validation. Up to 50 entries per input.

Reference: Official Wireshark display filter manual.

Data processing & privacy

The tools process entered addresses and generate results locally in your browser. They do not send inputs or results to a server.

Cloudflare hosts this website and receives the connection information required to deliver its pages. Cloudflare Web Analytics collects aggregate usage and performance metrics without analytics cookies or visitor fingerprinting.

Results are copied or downloaded only when you choose to do so. Always review generated configuration before applying it.