Wireshark Cheat Sheet: Capture, Filter, and Shortcuts Guide

Wireshark Cheat Sheet Notes

No. :
- Frame number from the beginging of the packet capture.
- Helps to identify the specific frame within the entire capture sequence.
Time:
- Seconds from the first frame.
- Useful for understanding the timing and sequence of network events.
Source (src). :
- Source address, commonly an IPv4, IPv6 or Ethernet address.
- Identifies the sender of the packet.
Destination (dst). :
- Destination address.
- Indicates the recipient of the packet.
Protocol:
- Protocol used in the Ethernet frame, IP packet, or TC segment.
- Examples include HTTP, TCP, UDP, etc.
Length:
- Length of the frame in bytes.
- Important for analyzing the size of the data being transmitted.

Operator	Description	Example
and &&	Logical AND	All the conditions should match.
or
xor or AA	Logical XOR	Exclusive alterations only if the two conditions should match not both.
not !	Not (Negation)	Not equal to.
[n....]	Substring operator	Filter a specific word or text.

Filter Type	Description
Capture Filter	Filter packets during capture.
Display Filter	Hide packets from a capture display.

Promiscuous mode:
- Sets interface to capture all packets on a network segment to which it is associated.
- Helps in capturing all traffic regardless of destination.
Monitor mode:
- Sets up the wireless interface to capture all traffic it can receive (Unix/Linux only).
- Useful for capturing wireless network traffic.

Syntax: protocol String 1 String 1 Comparison operator Value Logical Operator Expressions
Example: http dest ip 192.168.1.1 and tcp.port
Used to filter packets for display based on various criteria.

Accelerator	Description
Tab or Shift+Tab	Move between screen elements, e.g., from the toolbars to the packet list.
Tab or Shift+Tab	Move to the next packet or detail item.
Tab or Shift+Tab	Move to the previous packet or detail item.
Ctrl+ or F8	Move to the next packet, even if the packet list isn't focused.
Ctrl+< or F7	Move to the previous packet, even if the packet list isn't focused.
Ctrl+=	Move to the next packet of the conversation (TCP, UDP, or IP).
Ctrl+-	Move to the previous packet of the conversation (TCP, UDP, or IP).
Alt+or Optio	Move to the next packet within the selection history.
Alt+Shift+	In the packet detail, opens the selected tree item.
Shift+<	In the packet detail, closes the selected tree item and all of its children.
Ctrl+1 to Ctrl+4	In the packet list, activates the 1st packet, the 2nd packet, etc.
Shift+-	In the packet list, deactivates the next line.
TAB	Move forward through items sequentially.
Ctrl+<	In the packet detail, collapses the selected tree.

Remember, this cheat sheet summarises essential commands for efficient use and understanding of Wireshark, a powerful network protocol analyzer.

Reference:

www.comparitech.com