Fields you can filter on#

Look up every field the autocomplete offers, the operators it takes, and the values it suggests.

The autocomplete menu in the filter bar lists every field the capture knows about. Each field has a one-line description in the menu. Most fields also have a column equivalent in the packet list. This page is the full reference.

Address and host fields#

Field	What it matches
`sourceAddress`	The source IP address (IPv4 or IPv6).
`destinationAddress`	The destination IP address.
`srcMac`	The source hardware (MAC) address.
`dstMac`	The destination hardware (MAC) address.
`hostSni`	The server name from a TLS handshake or the host in an HTTP request.

You can type shorter aliases for the two IP fields: src or source resolve to sourceAddress, and dst, dest, or destination resolve to destinationAddress.

Transport fields#

Field	What it matches
`protocol`	The highest protocol detected in the frame (`TCP`, `UDP`, `DNS`, `TLS`, and so on).
`srcPort`	The source transport port.
`dstPort`	The destination transport port.
`length`	The total frame length in bytes.
`tcpFlags`	The TCP flag string (for example, `SYN`, `SYN ACK`, `FIN ACK`).
`tcpWindow`	The advertised TCP window size.
`tcpSegmentLength`	The length of the TCP segment payload in bytes.
`event`	The TCP event type, such as `Retransmission` or `Out-of-order`.
`stream_id`	The TCP stream identifier the workspace assigned to this conversation.

Frame fields#

Field	What it matches
`id`	The packet number, matching the No. column in the list.
`timestamp`	The packet's capture timestamp. Useful with `>` and `<` to bound a time range.
`info`	The text of the Info column (for example, `Standard query response`).
`ttl`	The IP time-to-live.

Suggested values#

For fields with a fixed set of values, the autocomplete offers the known options as you type. The protocol field suggests TCP, UDP, TLS, HTTP, HTTP/2, DNS, ARP, and more. The tcpFlags field suggests combinations such as SYN, SYN ACK, and FIN ACK. The event field suggests Retransmission, Out-of-order, Zero window, and the other TCP events. For address and port fields, the menu offers the values it has seen in the capture, each with a count.

Operators by field#

Numeric fields (length, srcPort, dstPort, tcpWindow, tcpSegmentLength, ttl, stream_id, id) accept the comparison operators =, >, <, >=, <=, and inclusive or exclusive ranges. Address and string fields accept = and the union, wildcard, and negation forms documented on Filter syntax.

The has: operator works on every field. It matches frames where the field is present, whatever the value:

has:tcpFlags

That expression keeps every TCP frame and drops everything else.

Common starting points#

A few short filters cover the cases you reach for most often:

dstPort:443: every frame sent to port 443.
sourceAddress:192.168.178.62: traffic from a single host.
protocol:DNS: every DNS query and response.
length:>1400: large frames, often application data rather than control traffic.
event:Retransmission: TCP segments the workspace flagged as retransmissions.