Prepare as Filter is a helpful feature in Wireshark that lets you build display filters step-by-step without instantly applying them. This gives you more control when constructing complex filters or combining multiple conditions. It’s ideal when you want to draft filters before running them, avoiding accidental narrowing of the view too soon.

Unlike Apply as Filter, which immediately filters the view, Prepare as Filter only copies the selected condition to the filter bar, allowing you to adjust or combine it before applying.

How to Use “Prepare as Filter”

To use this feature:

  1. Right-click on a field inside the Packet Details pane
  2. Select:
Prepare as Filter → [Choose how to insert it]

You can choose from:

  • Selected – insert as a standalone condition
  • Not Selected – insert as a negative match
  • And Selected / Or Selected – append to existing filter
  • Replace Expression – swap out the current filter

The expression appears in the filter bar, but it won’t run until you manually hit Enter or click Apply.

Example

Right-clicking an IP field and choosing “Prepare as Filter → Selected” might insert:

ip.addr == 10.0.0.5

You can then edit or add more filters before applying.