Wireshark allows you to quickly apply display filters based on selected packet fields. This makes it easy to isolate related traffic, focus on specific IPs, protocols, ports, or any detail shown in the packet. Instead of typing the entire filter manually, you can use the “Apply as Filter” option to instantly generate one from what you’re analyzing.
How to Use “Apply as Filter”
To apply a filter from any packet field:
- Right-click on the field of interest in the Packet Details pane
- Select:
Apply as Filter → [Selected Option]
You can choose from:
- Selected: show packets matching that value
- Not Selected: exclude packets with that value
- And Selected / Or Selected: combine with existing filters
This builds the correct display filter syntax automatically and applies it in the filter bar.
Example
If you right-click an IP address and choose “Apply as Filter → Selected,” Wireshark will create and apply something like:
ip.addr == 192.168.1.1This saves time and avoids typing errors when building filters manually.