How to Filter Traffic by Source IP Addresses in Wireshark

Here are a few ways to filter by source IP address, destination IP address, and protocol in Wireshark:

To show only HTTP traffic between two specific IP addresses:

(ip.src == and ip.dst == and http

To break this down:

  • ip.src == filters by source IP address
  • ip.dst == filters by destination IP address
  • and http further filters to only show HTTP protocol traffic

You can also filter by TCP/UDP ports in addition to IP addresses:

(ip.src == and tcp.srcport == 80 and ip.dst == and tcp.dstport == 8080) and http

This filters for HTTP traffic from port 80 to port 8080.

Some other examples:

(ip.addr == or ip.addr == and tcp.port == 80 

Show TCP port 80 traffic to/from or

(ip.src == or ip.dst == and udp 

Show all UDP traffic involving

The key is you can combine IP address, port, and protocol filters using and and or to precisely filter the traffic you want to analyze in Wireshark.