Wireshark Cheat Sheet – Commands, Captures, Filters & Shortcuts

Wireshark is a widely used open-source network protocol analyzer that allows users to capture and inspect data packets traveling across a network in real time. Originally developed by Gerald Combs in 1998, Wireshark has become one of the most powerful and essential tools for network administrators, cybersecurity professionals, and anyone interested in network troubleshooting and analysis.

The tool supports a vast range of network protocols and can decode hundreds of different types of data streams, making it suitable for various tasks such as diagnosing network issues, monitoring traffic, identifying security vulnerabilities, and ensuring compliance with network policies. Wireshark is a software package that installs on Windows, macOS, and Linux and you can download it for free.

Wireshark provides a user-friendly graphical interface, which displays captured packets with detailed information such as source and destination addresses, protocol types, and packet content. Users can apply filters to analyze specific types of traffic, search through capture files, and visualize network patterns. Additionally, Wireshark supports both wired and wireless networks, including advanced features like packet decryption for encrypted protocols like SSL/TLS.

Being open-source and actively maintained, Wireshark has a large and vibrant community contributing to its development. The analyzer is indispensable for professionals in fields such as network administration, security analysis, and software development, helping them to gain deep insights into network communications.

All the information that has been provided in the cheat sheet is also visible further down this page in a format that is easy to copy and paste.

Download the Wireshark Cheat Sheet

What’s included in the Wireshark cheat sheet?

The following categories and items have been included in the cheat sheet:

Wireshark Capturing Modes

Filter Types

Capture Filter Syntax

Display Filter Syntax

Protocols – Values

Filtering packets (Display Filters)

Miscellaneous Items

Logical Operators

Default columns in a packet capture output

Keyboard Shortcuts

Common Filtering Commands

Main Toolbar Items

Main toolbar items
Toolbar Icon	Toolbar Item	Menu Item	Description
	Start	Capture → Start	Uses the same packet capturing options as the previous session, or uses defaults if no options were set
	Stop	Capture → Stop	Stops currently active capture
	Restart	Capture → Restart	Restarts active capture session
	Options…	Capture → Options…	Opens “Capture Options” dialog box
	Open…	File → Open…	Opens "File open" dialog box to load a capture for viewing
	Save As…	File → Save As…	Save current capture file
	Close	File → Close	Close current capture file
	Reload	View → Reload	Reloads current capture file
	Find Packet…	Edit → Find Packet…	Find packet based on different criteria
	Go Back	Go → Go Back	Jump back in the packet history
	Go Forward	Go → Go Forward	Jump forward in the packet history
	Go to Packet…	Go → Go to Packet…	Go to specific packet
	Go To First Packet	Go → First Packet	Jump to first packet of the capture file
	Go To Last Packet	Go → Last Packet	Jump to last packet of the capture file
	Auto Scroll in Live Capture	View → Auto Scroll in Live Capture	Auto scroll packet list during live capture
	Colorize	View → Colorize	Colorize the packet list (or not)
	Zoom In	View → Zoom In	Zoom into the packet data (increase the font size)
	Zoom Out	View → Zoom Out	Zoom out of the packet data (decrease the font size)
	Normal Size	View → Normal Size	Set zoom level back to 100%
	Resize Columns	View → Resize Columns	Resize columns, so the content fits to the width

Lesser known yet handy Wireshark features

1. Statistics and analysis tools: Wireshark comes with a range of built-in tools to analyze network data. Examples include the ability to visualize statistics, like protocol hierarchy, endpoints, packet lengths, and more. I added this command as an example: Statistics > Protocol Hierarchy.
2. Stream Follow: The ability to follow a TCP, UDP, or SSL/TLS stream, which can be very useful for understanding what’s happening in a particular connection. I added this example: Right-click on a packet and select Follow > TCP Stream.
3. Exporting and Saving Data: Commands for exporting specific packets, saving packet data, or creating PCAP files can also be useful. I added this example: File > Export Specified Packets....
4. Capture Interfaces: Selecting and managing capture interfaces can be helpful. I added this example: Capture > Options > Manage Interfaces.
5. Time Display Format and Precision: Commands for changing the time display format and precision might also be helpful for some users. I added this example:, View > Time Display Format > Seconds Since Beginning of Capture.

More Wireshark tutorials:

• Wireshark cheat sheet
• How to decrypt SSL with Wireshark
• Using Wireshark to get the IP address of an Unknown Host
• Running a remote capture with Wireshark and tcpdump
• Wireshark ‘no interfaces found’ error explained
• Identify hardware with OUI lookup in Wireshark
• Best Wireshark alternatives

Wireshark FAQs