This bar is used to filter currently captures packets and network traffic according to the provided filters. Wireshark GUI provides the filter Bar in order to apply a display filter. Below we will list popular TCP and UDP protocols and their port numbers. TCP and UDP are the most popular protocols used for transmission and most network-related applications like websites, web applications, services, etc. Port numbers are used for TCP and UDP protocols. Popular TCP and UDP Port and Port Numbers As an advanced tool, it provides the ability to filter network traffic or packets according to the port or port number. It simply captures the network traffic for different protocols and provides it in a readable way to the user. This means, the SYN-bit (2) needs to be set, the ACK-bit (16) needs to be unset and all other bits in the TCP flags can be set or unset (as they were masked by the AND (&) operator.Wireshark is a popular network sniffing and analysis tool. If the result is exactly 2, then capture the packet. tcp&18 = 2 means: look at offset 0xd (13 in decimal) and then take it's value and then only look at the bits for SYN (2) and ACK (16) by doing a logical AND.This means the SYN-bit (2) and the ACK-bit (16) both needs to be set, but all other TCP flags must be unset tcp=18 means: look at offset 13 in the packet and only capture the packet when its value is 18.protocol names in a BPF filters are case sensitive, so you need to use 'udp' instead of 'UDP' and 'icmp' instead of 'UDP'.Both tcpdump and wireshark use the same filtering language (BPF), no need to convert.The filter will become something like: (tcp=18 or proto icmp or proto udp) and not (host 10.0.0.1 and udp port 53) and not (host 10.0.2.10 and tcp port 80) and not. Go back to step one, rinse and repeat :-).Add these interactions to the filter in a not clause.Analyze the traffic and and the top interactions to your list.

As there are probably a few top conversations, removing those from the capture process might significantly reduce the capture sizes. If you need to create an overview of connections and are not interested in the amount of the traffic, then you can iteratively remove traffic from the capture once you've added it to the list of interactions.

Wireshark filter destination ip