WireShark Quick Reference filter

Capture filter

host 192.168.0.1

not host 192.168.0.1

ether host 10:10:56:40:15:82

tcp port 80

ip and not broadcast and not multicast - only ip and no brodcast

not host 164.168.0.1 and ( arp or port 137 or port 138) - gives 
arp and brodcast

net 192.168.0.0 mask 255.255.255.0 - ( should be .0 in end of net .1 is syntax error)

http://wiki.wireshark.org/CaptureFilters - more
http://tiger.la.asu.edu/Quick_Ref/tcpdump_quickref.pdf.

Display filter

One word filters: dns, ip, tcp, utp, http, irc

ip.addr == 192.168.0.1

not ip.addr == 192.168.0.1

eth.addr == 00:11:11:35:11:14

tcp.port == 139

udp.dstport == 53 - show all dns queries (no answers)

http.request.uri contains "jpg" - search in url string on GET

Right click on a TCP packets choose "Follow TCP Streams" now HTML or XML commands show in plain text.

Menu Analyse -> expert info composite, show all or error and warnings

Menu Statistics -> Endpoint list-> IPv4 or TCP or UDP, give clear over datatrafics against different IP or ports 

Menu File -> export -> objects -> HTTP downloaded files or html pages

More display filter

frame.pkt_len < 1500 - filter out all max lenght packet

ip.addr eq sneezy/24

ip.addr == 129.111.0.0/16

ip.dst != 10.12.0.0/16

http.request.method == "GET"

frame[100-199] contains "wireshark"

http and frame[1-100] contains "GET"

http[0-3] contains "GET"

http[0-2] == "GET"

eth.src[0:3] == 00:00:83 - sort out a vendors mac