Wireshark Filter Port: Display and Capture Examples

Updated 8 November 2026 · Standard formula, shown below

To filter a port in Wireshark, use a display filter such as tcp.port == 443 or udp.port == 53 to show packets using that TCP or UDP port. Capture filters use different syntax: enter tcp port 443 or udp port 53 before starting a capture.

Display Filters and Capture Filters

Wireshark has two distinct filtering stages, and their syntax is not interchangeable. A capture filter limits which packets Wireshark collects. A display filter is applied to packets already captured and only controls which packets are shown.

Display filter: Enter it in the filter bar above the packet list. You can change or clear it without capturing the traffic again.
Capture filter: Set it in the capture options before capture begins. Packets excluded by this filter are generally not available later in that capture file.

For investigation, a display filter is often the more flexible choice: capture broadly enough to retain relevant traffic, then narrow the view as you learn what to look for. Use a capture filter when you need to reduce collection or limit the amount of data being recorded.

Common Port Display Filters

In a display filter, tcp.port matches a TCP source or destination port, while udp.port matches a UDP source or destination port. The equality operator is ==.

tcp.port == 80 — TCP packets with port 80 as the source or destination.
tcp.port == 443 — TCP packets involving port 443.
udp.port == 53 — UDP packets involving port 53, commonly used for DNS queries and responses.
tcp.port == 22 — TCP packets involving port 22, often used by SSH.
tcp.port == 80 or tcp.port == 443 — TCP packets involving either port.
tcp.port in {80 443} — another way to match either of those TCP ports.

Port numbers range from 0 through 65535. Wireshark does not require that a port be a familiar service port: filtering on a high, temporary client port is valid too. A port number indicates a transport-layer endpoint, not proof of the application or content carried by a packet.

Source, Destination, and Exact Matches

The general tcp.port and udp.port fields match either endpoint. To specify direction, use tcp.srcport or udp.srcport for the source, and tcp.dstport or udp.dstport for the destination.

tcp.dstport == 443 — TCP packets whose destination port is 443.
udp.srcport == 53 — UDP packets whose source port is 53, as in many DNS responses.
ip.addr == 192.0.2.10 and tcp.port == 443 — packets involving that IPv4 address and TCP port 443.

Direction is from the perspective of each packet, not from a permanent “client” or “server” label. In a request and reply, the source and destination ports normally swap. If you are unsure which endpoint is which, inspect the packet’s source and destination columns or expand its TCP or UDP details.

Capture Filter Syntax for Ports

Capture filters follow the Berkeley Packet Filter (BPF) syntax used by packet-capture tools. A port condition can be written as tcp port 443, udp port 53, or simply port 443 when you want to match either TCP or UDP traffic on that port.

tcp dst port 443 — TCP traffic destined for port 443.
udp src port 53 — UDP traffic from source port 53.
port 80 or port 443 — traffic using either port over TCP or UDP.
host 192.0.2.10 and tcp port 443 — TCP traffic on port 443 involving the specified host.

Set a capture filter in the capture-options interface before starting. The precise placement of controls can vary by Wireshark version and operating system, but the filter itself must use capture-filter syntax. An invalid or overly narrow capture filter can leave you with no useful packets to analyze.

Combining Filters and Finding Ports

Display filters support logical operators: and, or, and not. Parentheses clarify combinations, especially when mixing “and” and “or.” For example, ip.addr == 192.0.2.10 and (tcp.port == 80 or tcp.port == 443) shows packets involving the address and either TCP port.

If you do not know the port, start by selecting a packet of interest and examining its protocol details. The packet list may also show source and destination port values, depending on the protocol and column layout. For a TCP conversation, right-click a packet and use the available conversation or stream-following tools to inspect related traffic; these views can help identify the endpoints, but they do not replace a port filter.

To match a range, use comparisons in a display filter, such as tcp.port >= 8000 and tcp.port <= 8100. Remember that this tests either TCP endpoint. To apply the range only to destination ports, use tcp.dstport >= 8000 and tcp.dstport <= 8100.

Common Problems and Misconceptions

Using the wrong syntax: tcp.port == 443 is a display filter; tcp port 443 is a capture filter. Putting one into the other filter field will not work as intended.
Filtering only one transport: TCP and UDP are separate. If you want both, use tcp.port == 53 or udp.port == 53, not just one of those expressions.
Assuming a port proves the application: Applications can use nonstandard ports, and encrypted traffic may hide its contents. A port match identifies packet headers, not necessarily a service’s identity or the data exchanged.
Expecting absent packets to appear: A display filter cannot restore packets that were never captured, were dropped, or are outside the selected capture interface.
Confusing service names and numbers: Numeric port filters are explicit. A familiar name such as “https” is not a substitute for checking the actual protocol and port values in the packet.

For IPv6, TCP and UDP port fields work the same way: the transport port is still a TCP or UDP header field. Add an IPv6 address condition, such as ipv6.addr == 2001:db8::1 and tcp.port == 443, when you need to restrict the result to a particular IPv6 endpoint.

Frequently Asked Questions

What is the Wireshark filter for port 443?
Use tcp.port == 443 as a display filter for TCP packets involving port 443. For a capture filter, use tcp port 443.

How do I filter both TCP and UDP on one port?
For a display filter, write tcp.port == 53 or udp.port == 53. In a capture filter, port 53 matches either TCP or UDP.

How can I filter only the destination port?
Use a direction-specific display field, such as tcp.dstport == 443 or udp.dstport == 53. Capture-filter syntax uses forms such as tcp dst port 443.

Why does my port filter show no packets?
Check that you chose the right transport, used the correct syntax for the filter field, and captured the relevant interface and time period. The port may also be the source port rather than the destination port.

Can I filter a range of ports?
Yes. For TCP display filtering, use a condition such as tcp.port >= 8000 and tcp.port <= 8100. Use tcp.dstport instead if only destination ports should count.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.