How To Filter By Port In Wireshark?

Wireshark is a popular network sniffing and analysis tool. It simply captures the network traffic for different protocols and provides in a readable way to the user. As an advanced tool, it provides the ability to filter network traffic or packets according to the port or port number.

Popular TCP and UDP Port and Port Numbers

Port numbers are used for TCP and UDP protocols. TCP and UDP are the most popular protocols used for transmission and most of the network-related applications like websites, web applications, services, etc. uses TCP and UDP. Below we will list popular TCP and UDP protocols and their port numbers.

Filter Port From Filter Bar

Wireshark GUI provides the filter Bar in order to apply a display filter. This bar is used to filter currently captures packets and network traffic according to the provided filters. This filter bar provides help with IntelliSense by listing available filters. The provided filter can be applied to the package list with the array button on the left side of the filter bar like below.

tcp.port == 80
Wireshark Port Filter

As the tcp.port == 80 is used to filter port number 80 the == can be changed with the eq which is the short form of the equal.

tcp.port eq 80

IANA assigns port numbers for different protocols HTTP is used for 80, HTTPS is used for 443, etc. Wireshark also supports the protocol names in order to specify the port number where the protocol standardized the port number.

tcp.port eq 80

Also like the TCP protocol the UDP protocols and port numbers can be filtered with the following filter.

udp.port == 53
Wireshark UDP Port Filter

Filter Multiple Ports

Wireshark also supports multi port filtering where multiple ports can be specified to math with a OR logic. The || signs are used to add multiple filter port where packages will be listed where one of the port number match. In the following example we will match both HTTP and HTTPS ports or 80 and 443 ports.

tcp.port == 80 || tcp.port == 443

or another alternative for the same filter

tcp.port eq 80 || tcp.port eq 443

Filter According The Source Port or Destination Port

A TCP or UDP packet contains the source port and destination port numbers. By default the tcp.port or udp.port expressions filter both the source port and destination ports unless they are not expressed explicitly. Previously explained port filters filter both source and destination ports. But we can specify the source or destination port number for filter explicitly by using the srcport or dstport according to the port term.

tcp.dstport == 80
tcp.srcport == 80

Leave a Comment