Wireshark display filter cheatsheet

Build your filter using these primitives, then submit it on the parent page.

HTTP fields

Field	What it matches
`http.request.method`	GET, POST, etc.
`http.request.uri`	Path + query only (no host)
`http.request.full_uri`	scheme + host + path
`http.user_agent`	User-Agent header value
`http.host`	Host header
`http.response.code`	200, 302, 404, …

Operators

==      equality            http.host == "example.com"
!=      inequality          http.response.code != 200
contains  substring match   http.request.uri contains "admin"
matches   regex             http.user_agent matches "(?i)sqlmap"
&&      logical AND
||      logical OR
!       NOT

Example tasks

Show only POST requests	`http.request.method == "POST"`
Show 4xx responses	`http.response.code >= 400 && http.response.code < 500`
Show requests with sqlmap UA	`http.user_agent contains "sqlmap"`

Your task is in the left pane.