Useful Wireshark filter examples

In my experience working with Wireshark, mastering filters dramatically improves your ability to pinpoint relevant network traffic quickly. For instance, using filters like `ip.addr == 10.0.0.1` enables you to see all traffic involving that specific IP address, which is critical when tracking suspicious hosts during an investigation. Filtering by protocol or port, such as `tcp.port == 80` or `icmp.type == 3`, lets you narrow down to the type of communication or error messages you want to analyze. One particularly useful trick I've found is combining source and destination IP filters, e.g., `ip.src == 10.0.0.1 && ip.dst == 10.0.0.2`, to trace a conversation between two systems. Excluding traffic with filters like `!(ip.addr == 10.0.0.1)` helps eliminate noise from commonly noisy hosts. Attention to flags in TCP packets, such as `tcp.flags.syn == 1` or `tcp.analysis.retransmission`, is invaluable for diagnosing connection issues or detecting possible intrusion attempts. When performing penetration testing, filtering on protocols outside TCP/UDP with `!(tcp or udp)` can uncover less common or suspicious traffic, often overlooked. Filters targeting DHCP traffic (`dhcp and ip.addr == 10.0.0.0/24`) or specific MAC addresses help in precise network inventory or identifying unauthorized devices. DNS query filters like `dns.gry.name contains "cnn.com"` can monitor for suspicious domain lookups. Lastly, Wireshark filters for encrypted traffic, such as `tls.handshake.type == 1` to isolate client hello packets, aid in analyzing TLS negotiation phases. Utilizing these filters not only streamlines workflow but also equips both blue and red teams with the tools needed to detect, analyze, and respond to security events efficiently. Combining these examples with your practical network scenarios will boost your effectiveness as a network analyst or security professional.