---
title: Filtering Traffic in wireshark
tags:
---
# Filtering for IP Addresses, Source or Destination


## IP

:::info
IP filter
`ip.addr==192.168.56.01`
:::

source &destinion 都包含192.168.56.01


:::info
限定source IP
`ip.src==192.168.56.01`
:::


:::info
限定destination IP
`ip.dst==192.168.56.01`
:::


:::info
限定subnet
`ip.addr==192.168.56.0/24`
:::



勾選 Limit to display filter
-> only shows conversations only matching the current display filter

## Filtering for Protocols and Port Numbers

Analyze -> display filters 裡面有小抄可以參照


HTTP TS 時使用Layer4： TCP + port 去看 before HTTP前的資料
`tcp.port==80`

單用HTTP 查詢 看不到之前的資料

## Filtering for Conversations