At the network layer, Wireshark provides extensive filters for IPv4 and IPv6, the cornerstones of modern internet communication. For IPv4, ip.ttl isolates packets with specific Time-to-Live values, useful for tracing operating systems or detecting traceroute patterns. Fragmentation analysis is supported through ip.frag_offset and the related flags ip.flags.mf (More Fragments) and ip.flags.df (Don't Fragment). The generic ip.proto field allows filtering by IP protocol number, with common values including 6 for TCP and 17 for UDP, while ip.addr, ip.src, and ip.dst handle address matching. IPv6 analysis uses analogous fields prefixed with ipv6., such as ipv6.addr, ipv6.src, ipv6.dst, ipv6.hop_limit, ipv6.nxt for the next header, and extension header fields like ipv6.hopopts, ipv6.routing, and ipv6.fragment. The IPv6 traffic class and flow label are accessible through ipv6.traffic_class and ipv6.flow_label, and the specific next-header protocol is selected with values like 6 for TCP, 17 for UDP, and 58 for ICMPv6.
The Transmission Control Protocol is one of the richest dissection targets, with filters spanning connection state, error conditions, and advanced options. TCP flags are exposed as individual fields, allowing expressions such as tcp.flags.syn == 1 && tcp.flags.ack == 0 to capture connection initiations, tcp.flags.fin == 1 for graceful teardowns, and tcp.flags.rst == 1 for resets. SYN-ACK packets, which complete the three-way handshake, are caught by tcp.flags.syn == 1 && tcp.flags.ack == 1, and connection refusal by tcp.flags.reset == 1 && tcp.flags.ack == 1. Beyond flags, Wireshark flags common TCP anomalies: tcp.analysis.retransmission, tcp.analysis.fast_retransmission, tcp.analysis.spurious_retransmission, tcp.analysis.duplicate_ack, tcp.analysis.out_of_order, tcp.analysis.lost_segment, and tcp.analysis.previous_segment_not_captured all surface different kinds of delivery problems. Flow-control issues appear as tcp.window_size == 0 (zero window) and tcp.analysis.window_update, while TCP options are exposed under tcp.options, including mss_val, wscale_val, timestamp.tsval, sack, sack_perm, and nop. TCP sequence numbers and acknowledgments are accessible through tcp.seq and tcp.ack, urgent data through tcp.urgent_pointer, and specific streams through tcp.stream. The reassembled data for a TCP segment is accessible via tcp.reassembled_in, and any payload is detected with tcp.len > 0.
The Internet Control Message Protocol, in both IPv4 and IPv6 variants, is dissected with type and code fields that mirror the protocol's semantics. ICMPv4 filters use icmp.type and icmp.code, where type 8 is echo request (ping), type 0 is echo reply, type 3 covers destination unreachable (with codes 0-4 distinguishing network, host, protocol, port, and fragmentation-needed variants), type 4 is source quench, type 5 is redirect (with codes 0-1 for network and host), type 11 is time exceeded (code 0 for transit, code 1 for reassembly), type 12 is parameter problem, and types 13 through 16 handle timestamp and information requests. ICMPv6 uses icmpv6.type with values such as 1 (destination unreachable), 2 (packet too big), 3 (time exceeded), 4 (parameter problem), 128 (echo request), 129 (echo reply), 133 (router solicitation), 134 (router advertisement), 135 (neighbor solicitation), and 136 (neighbor advertisement), forming the backbone of Neighbor Discovery Protocol analysis. ARP analysis uses arp.opcode with 1 indicating requests and 2 indicating replies, alongside structural fields like arp.hw.type, arp.proto.type, arp.hw.size, arp.proto.size, and arp.dst.proto_ipv4 for matching a specific IP being resolved. The Dynamic Host Configuration Protocol dissects messages via bootp.option.type == 53 (the DHCP message type option) combined with a value field distinguishing Discover (1), Offer (2), Request (3), Decline (4), ACK (5), NAK (6), Release (7), and Inform (8) messages, with dhcp.option.dhcp providing a convenient shorthand for the same conditions.