There are 935 supported protocols, so you should be able to choose the one you want! If you want inbound packets only, use ip.dst.) If you want to see only packets for a specific protocol, it’s even easier: just type in the protocol name (ARP, DNS, HTTP, etc.) in the filter field.

(If you want to only see outbound packets from this address, use ip.src instead of ip.addr. If you want to see only packets coming into or going out of 10.10.1.20, simply enter ip.addr = 10.10.1.20 in this filter field and hit Enter. There’s a “filter” field just below the button bar in which you can type a filter expression that will limit the display. Now while it can be useful to have an overview of everything, usually when troubleshooting a problem or trying to understand a network “conversation,” you’ll want at some point to restrict the packet list based on certain criteria.įor example, you may only be interested in traffic to or from a given host. If you chose to perform a “promiscuous mode” capture then you could see packets from multiple sources.

Unless you specify a filter when you create the capture file in Wireshark, you’ll see all the captured packets in the packet list pane.

Wireshark filters ip