Click any field for why it matters, what a suspicious value looks like, its IOC type, and a ready display filter.
Display Filters
The filter idioms you chain together before you ever get to a specific field.
ip.addr == 198.51.100.203 and tcp.flags.syn == 1 and tcp.flags.ack == 0
ip.addr == details →
Match a host as either source or destination.
Host filter
tcp.port == details →
Match a port as either source or destination.
Port filter
http / dns / tls details →
Filter to one protocol's traffic.
Protocol filter
contains details →
Match a field containing a text fragment.
String match
matches details →
Regex-match a field against a pattern.
Pattern match
and / or / ! details →
Combine or exclude multiple conditions.
Combinator
tcp.analysis.flags details →
Match Wireshark's own flagged TCP anomalies.
Anomaly filter
!(...) exclude details →
Hide chatty background protocols.
Noise reduction
Capture filter (BPF) details →
Set before capture — discards, doesn't just hide.
Capture-time
TCP Flags · Nmap Scans
Which flag combinations are a normal handshake, and which ones are a scan or a stalled connection.
tcp.flags.syn == 1 and tcp.flags.ack == 0
SYN (no ACK) details →
Handshake start, or a half-open scan probe.
Recon signal
Full handshake details →
The normal SYN → SYN-ACK → ACK sequence.
Baseline
RST details →
Abrupt connection reset — often a closed-port reply.
Recon signal
FIN / NULL / XMAS scan details →
Stealth scan flag combinations.
Recon signal
tcp.window_size == 0 details →
Receiver's buffer is full — connection stalling.
Congestion signal
tcp.analysis.retransmission details →
A segment Wireshark identified as resent.
Anomaly signal
tcp.analysis.duplicate_ack details →
Receiver re-acknowledging a missing segment.
Anomaly signal
Layer 3 / 4
The addressing and delivery fields underneath every other protocol on this page.
ip.dst == 198.51.100.203 and tcp.dstport == 4444
ip.src / ip.dst details →
Source and destination IP of the packet.
Network IOC
ip.ttl details →
Hop count remaining — can hint at OS or spoofing.
Host IOC
ip.flags.mf details →
Whether the packet is a fragment of a larger one.
Network IOC
tcp.srcport / dstport details →
Source and destination TCP ports.
Network IOC
tcp.seq / tcp.ack details →
Byte ordering and delivery confirmation.
Anomaly signal
Common ports reference details →
The well-known ports every other category on this page builds on.
Reference
Cleartext Auth · Hash Capture
The ports and protocols worth checking first when the question is specifically "did a credential cross the wire here."
ftp.request.command == "PASS" or ldap.simple or ntlmssp
FTP — 21 details →
Cleartext USER/PASS login commands.
Cleartext
Telnet — 23 details →
Unencrypted terminal session, keystroke by keystroke.
Cleartext
HTTP Basic Auth — 80 details →
Base64-encoded credential in the Authorization header.
Encoded, not encrypted
SMB / NTLM — 445 details →
NTLM challenge/response — crackable or relayable.
Hash capture
LLMNR / NBT-NS / mDNS details →
Broadcast name resolution — Responder's target.
Poisoning attack
POP3 / IMAP — 110 / 143 details →
Cleartext mailbox password, sent on every check-in.
Cleartext
LDAP simple bind — 389 details →
Cleartext distinguished name and password.
Cleartext
Kerberos AS-REP — 88 details →
Ticket exchange — extractable, crackable offline.
Offline cracking
RDP — 3389 details →
Encrypted, but a common lateral-movement target.
Encrypted target
SNMP — 161 details →
Community string acts as a cleartext password.
Cleartext
Layer 7 · Cleartext
Unencrypted web traffic — the most directly readable evidence a capture can hand you.
http.request.method == "POST" and http.host contains "cvp-verify"
http.host details →
Domain requested, independent of the destination IP.
Web IOC
http.request.method details →
HTTP verb used for the request.
Web IOC
http.user_agent details →
Self-reported client application string.
Host IOC
http.response.code details →
HTTP status code returned by the server.
Web IOC
http.file_data details →
The actual request or response body content.
File IOC
Layer 7 · Resolution
Resolution requests often surface a callback domain before the connection itself ever shows up.
dns.qry.name matches "^[a-z0-9]{12,}\\."
dns.qry.name details →
Domain name being resolved.
Web IOC
dns.a details →
IP address(es) the query resolved to.
Network IOC
dns.qry.type details →
Type of DNS record requested.
Network IOC
dns.flags.rcode details →
Success/failure result of the DNS query.
Host IOC
Layer 7 · Encrypted
What's still visible before encryption kicks in, and what the certificate itself reveals.
tls.handshake.extensions_server_name contains "cloudvaultpro"
SNI details →
Domain requested in the TLS ClientHello, unencrypted.
Web IOC
tls.handshake.type details →
Which TLS handshake message this packet is.
Protocol filter
x509sat.CN details →
Certificate Common Name / Subject Alt Names.
Web IOC
tls.handshake.version details →
Negotiated TLS version and cipher suite.
Host IOC
TLS session keys details →
Decrypt HTTPS in Wireshark, if keys were logged.
Decryption
Layer 2 · Local Network
The layer where spoofing happens closest to the wire, and where a device first identifies itself before an IP address even enters the picture.
arp.opcode == 2 and arp.isgratuitous == 1
arp.opcode details →
Whether the packet is an ARP request or reply.
Recon signal
arp.src.hwaddr details →
MAC address claiming an IP in a reply.
Host IOC
Gratuitous ARP details →
Unsolicited ARP reply broadcast to the network.
Recon signal
arp.duplicate-address-detected details →
Wireshark's own automatic ARP-conflict flag.
Automated detection
dhcp.option.hostname details →
Self-reported hostname at DHCP lease request.
Host IOC
DHCP Offer (rogue server) details →
Who is actually answering DHCP requests on the segment.
Recon signal
Layer 3 · Diagnostics
Meant for network diagnostics — but also a quiet channel for sweeps and covert tunnels.
icmp.type == 8 and data.len > 64
icmp.type details →
ICMP message type (echo, reply, unreachable...).
Recon signal
ICMP payload size details →
Oversized or varying echo payloads — tunneling tell.
Covert channel
icmp.type == 3 details →
Destination unreachable — often a UDP scan reply.
Recon signal
Wireshark Menu · CLI
The aggregate views that surface a pattern across the whole capture, and the command-line tool for when there's more than one capture to look at.
Statistics → Conversations
Conversations details →
Summary table of every distinct conversation.
Summary view
Endpoints details →
Per-host totals, independent of who they talked to.
Summary view
Protocol Hierarchy details →
Breakdown of every protocol present, by percentage.
Summary view
Expert Info details →
Wireshark's automated warnings and errors pass.
Automated triage
IO Graph details →
Traffic volume over time, filterable.
Summary view
TShark details →
Command-line Wireshark, for scripting and automation.
Automation
No fields match that filter.