Hypertext Transfer Protocol dissection is one of Wireshark's most mature and richly featured areas. HTTP methods are filtered with http.request.method, supporting equalities like "GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS", "PATCH", "TRACE", and "CONNECT". Status codes are accessible through http.response.code, allowing ranged expressions such as http.response.code == 404 for not found, http.response.code == 401 for unauthorized, http.response.code == 407 for proxy authentication required, http.response.code >= 500 for server errors, and http.response.code >= 300 && http.response.code < 400 for redirects. Common headers are exposed as individual fields: http.host, http.user_agent, http.cookie, http.authorization, http.set_cookie, http.connection (which captures "keep-alive" versus "close"), http.transfer_encoding, http.content_type, http.content_encoding, http.cache_control, http.etag, http.last_modified, and http.if_modified_since. Body content can be searched through http.request.uri and the generic http.file_data field, while version-specific filters like http.request.version == "HTTP/1.0" support protocol-version studies.
The TLS and SSL protocols, often summarized under the tls and ssl filter aliases, expose the handshake steps and record types that underpin secure web traffic. tls.handshake.type identifies specific handshake messages, with 1 for Client Hello, 2 for Server Hello, 11 for Certificate, 12 for Server Key Exchange, 13 for Certificate Request, 14 for Server Hello Done, 15 for Certificate Verify, 16 for Client Key Exchange, and 20 for Finished. tls.record.content_type distinguishes handshake (22), alert (21), and application data (23). TLS versions can be pinpointed with tls.version, where 0x0301 corresponds to TLS 1.0, 0x0302 to 1.1, 0x0303 to 1.2, and 0x0304 to 1.3, while tls.handshake.ciphersuite enumerates the negotiated algorithms. The legacy ssl.version field covers SSL 2.0 (0x0002) and SSL 3.0 (0x0300).
DNS dissection is another standout, exposing both query metadata and response flags. Query types use dns.qry.type with values including 1 (A), 5 (CNAME), 12 (PTR), 15 (MX), 16 (TXT), and 28 (AAAA), while query classes use dns.qry.class (1 for IN, 3 for CH, 4 for HS). Domain-specific filtering uses dns.qry.name combined with == for exact matches, contains for substrings, and matches for regex. Response codes are surfaced through dns.flags.rcode, with 0 for NOERROR, 2 for SERVFAIL, and 3 for NXDOMAIN. Direction can be determined by dns.flags.response, where 1 marks responses and 0 marks queries, and additional flags such as dns.flags.authoritative, dns.flags.truncated, dns.flags.recdesired, dns.flags.recavail, dns.flags.authentic, and dns.flags.checkdisable reveal resolver behavior. Record counts are exposed through dns.count.answers, dns.count.auth_rr, and dns.count.add_rr for response analysis.
Beyond HTTP and DNS, Wireshark supports a wide range of application protocols. Email is handled by smtp, pop3, imap, and their secure variants pop3s and imaps. Remote access uses ssh and telnet. File sharing includes ftp (and its data channel), smb with smb.cmd for older dialects and smb2 with command codes (1 for session setup, 3 for tree connect, 5 for create, 8 for read, 9 for write), nfs with procedure codes such as 0 (null), 1 (getattr), 4 (lookup), 6 (read), 7 (write), 9 (create), 10 (remove), 11 (rename), 12 (link), 13 (symlink), 14 (mkdir), 15 (rmdir), 16 (readdir), and 17 (statfs), afp, and iscsi with opcodes spanning login (0x23), SCSI commands (0x01), responses (0x21), data transfer (0x05 and 0x25), R2T (0x31), logout (0x06 and 0x26), and NOP (0x00 and 0x20). Directory services use ldap, time synchronization uses ntp, and authentication uses kerberos whose msg_type field identifies AS-REQ (10), AS-REP (11), TGS-REQ (12), TGS-REP (13), AP-REQ (14), and AP-REP (15). Storage-area networking extends to fcoe for Fibre Channel over Ethernet, where fcoe.fc.ct.cmd distinguishes FLOGI (0x20), PLOGI (0x21), PRLI (0x22), and LOGO (0x23), and infiniband for high-performance fabrics, with infiniband.mad.mgmt_class partitioning management datagrams into base (1), subnet (2), communication (3), performance (4), device (5), SNMP tunneling (6), and vendor-specific (7) classes.
Routing and link-layer discovery protocols occupy their own corner of the application layer. Interior gateway protocols include ospf with msg codes 1 through 5 for Hello, Database Description, Link State Request, Link State Update, and Link State Acknowledgment; eigrp; and rip. The exterior gateway protocol bgp exposes its message types via bgp.type, with 1 for OPEN, 2 for UPDATE, 3 for NOTIFICATION, 4 for KEEPALIVE, and 5 for ROUTE REFRESH. Link-layer discovery is handled by cdp with cdp.deviceid, cdp.platform, and cdp.capabilities for Cisco Discovery Protocol and lldp with lldp.tlv.chassis.id, lldp.tlv.port.id, and lldp.tlv.ttl for the vendor-neutral Link Layer Discovery Protocol. Spanning Tree Protocol is dissected through stp, with stp.type distinguishing configuration BPDUs (0) from topology change notifications (128), alongside stp.root.priority and stp.root.cost. Wireless analysis uses the wlan.fc.type family of fields, where 0 selects management frames, 1 selects control frames, and 2 selects data frames, with type_subtype further distinguishing beacons (8), probe requests (4), probe responses (5), authentication (11), association requests (0), association responses (1), and deauthentication (12). Tunneling protocols are supported by gre, esp, ah, isakmp, vxlan, and geneve.
Modern application protocols include http2 with its frame types (0 for DATA, 1 for HEADERS, 4 for SETTINGS, 5 for PUSH PROMISE, 6 for PING, 7 for GOAWAY, 8 for WINDOW UPDATE, 9 for CONTINUATION); quic with packet types spanning Initial (0), Version Negotiation (1), Handshake (2), 0-RTT (3), and 1-RTT (the short header); websocket with opcodes for text (1), binary (2), close (8), ping (9), pong (10), and the FIN and masked flags; and sip with methods such as INVITE, ACK, BYE, CANCEL, REGISTER, and OPTIONS, alongside status codes including 100 Trying, 180 Ringing, 200 OK, 404 Not Found, 486 Busy Here, 487 Request Terminated, and 503 Service Unavailable. Voice and video use rtp with rtp.p_type, rtp.seq, rtp.timestamp, rtp.ssrc, rtp.marker, and rtp.payload fields, alongside rtcp with packet types 200 through 204 for sender report, receiver report, source description, goodbye, and application-defined messages. Legacy telephony is captured by h323, with h323.h225.msg_type distinguishing setup (5), call proceeding (2), alerting (1), connect (7), and release complete (90), and by mgcp with verb commands like CRCX, MDCX, DLCX, RQNT, and AUEP. NetBIOS services are accessed through nbns, nbds, and nbss.