Wireshark Tips for use

Common shortcut keys:

Ctrl-f: Open the Find Packet window

Ctrl-n: Next matching packet

Ctrl-b: Last matching packet

CTRL-M: Mark selected packets/Cancellation tags

Shift-ctrl-n: Next Tagged packet

Shift-ctrl-b: Previous tagged packet

CTRL-T: Set current packet as relative reference

Capture filter expression (BPF syntax)

An expression contains: N Primitives + operators (n can be 1)

A primitive contains: N Qualifiers + ID/number (an example of ID/number, ip/port)

BPF qualifiers, such as the following table:

Qualifying words	Description	Example
Type	The meaning of the ID/number represented	Host,net,port
Direction	Represents the direction, source, or destination of a packet	Src,dst
Protocol	Agreement	Ether,ip,tcp,udp,http,ftp

Operators include: And Or not (&&,| |,! ）

A comprehensive example: DST host 192.168.0.10 && TCP port 80

Wireshark Tips for use