The 'Filter Expression' dialog box can help you build display filters. For display filters, try the display filters page on the Wireshark wiki. For example, to capture only packets sent to port 80, use: dst tcp port 80Ĭouple that with an http display filter, or use: tcp.dstport = 80 & httpįor more on capture filters, read ' Filtering while capturing' from the Wireshark user guide, the capture filters page on the Wireshark wiki, or pcap-filter (7) man page. If you want to measure the number of connections rather than the amount of data, you can limit the capture or display filters to one side of the communication. By default Wireshark will capture all packets for you, for specific filter like in screenshot below I choose to only capture http request. Go back to your Wireshark screen and there you can see the network traffics. Visit the URL that you wanted to capture the traffic from. For example, to display only those packets that contain TCP protocol, just write the name of the protocol in the filter text box. Filter results by protocol You can easily filter the results based on a particular protocol.

Note that a filter of http is not equivalent to the other two, which will include handshake and termination packets. Click on the Start button to start capturing traffic via this interface. In the following section, we will discuss 5 useful Wireshark display filter through examples. Ping packets should use an ICMP type of 8 (echo) or 0 (echo reply), so you could use a capture filter of: icmpĪnd a display filter of: icmp.type = 8 || icmp.type = 0įor HTTP, you can use a capture filter of: tcp port 80

Wireshark filter http json