# Mastering Display Filters

PCAP files often contain hundreds of thousands or even millions of packets. Manually scrolling through them is impossible. **Display Filters** are your strongest weapon as an analyst to cut through the noise and find the signal.

*Important:* Do not confuse Display Filters with Capture Filters. Capture filters decide what data gets written to disk. Display filters hide/show data that has already been captured.

## Filter Syntax Basics
Wireshark uses a very specific syntax for filtering.

*   `.==` (Equals): `ip.addr == 192.168.1.100`
*   `.!=` (Not Equals): `ip.src != 10.0.0.5`
*   `.>` (Greater Than): `frame.len > 1500`

## IP and Protocol Filtering
*   **By IP Address:**
    *   `ip.src == 8.8.8.8` (Shows only packets originating *from* 8.8.8.8)
    *   `ip.dst == 8.8.8.8` (Shows only packets going *to* 8.8.8.8)
    *   `ip.addr == 8.8.8.8` (Shows packets where 8.8.8.8 is *either* the source or destination)
*   **By Protocol:** Just type the protocol name.
    *   `http`
    *   `dns`
    *   `tcp`
*   **By Port:**
    *   `tcp.port == 443` (Shows HTTPS traffic)
    *   `udp.port == 53` (Shows DNS traffic)

## Boolean Operators (Combining Filters)
To find highly specific events, you must chain filters together.

*   **AND (`&&`):** Both conditions must be true.
    *   `ip.src == 192.168.1.50 && tcp.port == 80` (Finds HTTP traffic originating from a specific laptop).
*   **OR (`||`):** Only one condition needs to be true.
    *   `tcp.port == 80 || tcp.port == 443` (Shows both HTTP and HTTPS traffic).
*   **NOT (`!`):** Excludes traffic.
    *   `ip.addr == 192.168.1.50 && !(dns)` (Shows all traffic for that IP *except* DNS queries).

## Advanced Filtering (Contains and Matches)
*   **Contains:** Searches for a specific string payload inside the packets.
    *   `http contains "password"` (Searches all unencrypted HTTP packets for the word "password").
*   **Matches:** Uses Regular Expressions (Regex) for powerful pattern matching.
    *   `http.host matches ".(cn|ru)$"` (Finds HTTP traffic going to Russian or Chinese top-level domains).