8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing Habits « Null Byte

8 Wireshark Filters
http://null-byte.wonderhowto.com/inspiration/8-wireshark-filters-every-wiretapper-uses-spy-web-conversations-and-surfing-habits-0134508/

ip.addr ==x.x.x.x

     Find packets with IP address as either source or destination

ip.addr ==x.x.x.x && ip.addr ==x.x.x.x

     conversation filter between the two IP addresses

http or dns

     filter based on protocol

tcp.port==xxx

     filters based on TCP port numbers

tcp.flags.reset==1

     filters to show all TCP resets.  A TCP reset basically kills a TCP connection instantly.

http.request

     Sets a filter for all HTTP GET and POST requests. This will show webpages being accessed for the most part.

tcp contains xxx

     Find TCP packets containing string.

(arp or icmp or dns)

     filter out protocols. The example hides ARP, ICMP, and DNS packets.