HTTP filtering is one of the most common tasks in Wireshark, and the http filter alone captures every HTTP packet. Requests can be narrowed further by method using http.request.method, with values like "GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS", "PATCH", "TRACE", and "CONNECT" corresponding to the standard HTTP verbs. Response status codes are tested with http.response.code, enabling filters such as http.response.code == 404 for missing resources, http.response.code == 401 for authentication challenges, http.response.code == 407 for proxy authentication, http.response.code == 200 for successful responses, and http.response.code >= 500 to surface any server-side error. Ranges like http.response.code >= 300 && http.response.code < 400 reveal redirects.
HTTP headers and metadata are also filterable. Common expressions include http.host == "example.com" to find requests aimed at a particular site, http.request.uri contains "/api/" to isolate API traffic, http.user_agent contains "Chrome" to identify a specific browser, and http.user_agent matches "(bot|crawler|scanner)" to flag automated clients. Content negotiation is visible through http.content_type, which can be combined with contains "json" or contains "xml" to isolate REST or SOAP traffic, while http.content_encoding == "gzip" identifies compressed responses. Other useful headers include http.cookie, http.set_cookie, http.authorization, http.transfer_encoding, http.cache_control, http.etag, and http.last_modified. For connection behavior, http.connection == "keep-alive" identifies HTTP/1.1 persistent connections, while http.connection == "close" marks non-persistent ones.
DNS filters operate at several layers of detail. The bare dns filter matches any DNS packet, while dns.flags.response == 0 isolates queries and dns.flags.response == 1 isolates replies. Specific query types are selected with dns.qry.type, including 1 for A records, 28 for AAAA (IPv6), 15 for MX, 12 for PTR (reverse lookups), 5 for CNAME, and 16 for TXT. A specific name can be matched with dns.qry.name == "example.com" or via a regex such as dns.qry.name contains "example.com". Response codes are checked with dns.flags.rcode, where 0 is NOERROR, 3 is NXDOMAIN, and 2 is SERVFAIL. Flags like dns.flags.authoritative, dns.flags.recdesired, dns.flags.recavail, dns.flags.truncated, dns.flags.authentic, and dns.flags.checkdisable describe the behavior negotiated between client and server. DHCP filters rely on bootp.option.type == 53 combined with a numeric value, producing messages for Discover (1), Offer (2), Request (3), Decline (4), ACK (5), NAK (6), Release (7), and Inform (8). Other protocol families follow the same pattern: TLS uses fields like tls.handshake.type (1 for Client Hello, 2 for Server Hello, 11 for Certificate, 20 for Finished) and tls.record.content_type (22 for handshake, 21 for Alert, 23 for application data); ICMPv6 uses icmpv6.type (133 for Router Solicitation, 134 for Router Advertisement, 135 for Neighbor Solicitation, 136 for Neighbor Advertisement, 128/129 for echo request/reply); and SIP uses sip.Method and sip.Status-Code to match specific requests and responses.