Almost every protocol Wireshark can dissect has a short, intuitive filter name. The core transport and network protocols use just their names: tcp, udp, icmp, arp, ip, and ipv6 all work directly. Application-layer protocols are similarly concise, with filters such as http, tls, dns, dhcp, smtp, pop3, imap, ftp, ssh, snmp, ntp, smb, and ldap. Newer or specialized protocols like http2, quic, websocket, sip, rtp, rtcp, kerberos, nfs, and iscsi each have their own dedicated filters, making it easy to isolate a single service in a mixed capture.
Address-based filtering follows predictable field naming. For IPv4 traffic, ip.addr matches either source or destination, while ip.src and ip.dst restrict to a single direction; the equivalent for Ethernet is eth.addr, eth.src, and eth.dst, and for IPv6 it is ipv6.addr, ipv6.src, and ipv6.dst. VLAN, MPLS, and tunneling protocols are accessible through filters such as vlan.id, mpls.label, vxlan, and geneve, which are invaluable when analyzing enterprise or service-provider networks. Specific IP protocol numbers can also be targeted directly, for example ip.proto == 6 for TCP and ip.proto == 17 for UDP, allowing precise matching without relying on the higher-level protocol dissectors.
Port-based filtering is just as flexible. tcp.port and udp.port match either end of a conversation, while tcp.srcport, tcp.dstport, udp.srcport, and udp.dstport narrow to one side. Common service filters therefore reduce to expressions like tcp.port == 80, udp.port == 53, or sip on its standard port 5060. When a non-standard port is in use, combining a port filter with a protocol dissector via the Decode As feature lets Wireshark reinterpret traffic correctly, after which the usual protocol filters apply as expected.