6.8. Finding Packets
Prev | Chapter 6. Working With Captured Packets | Next

## 6.8. Finding Packets

You can easily find packets once you have captured some packets or have read in a previously saved capture file. Simply select Edit → Find Packet…​ in the main menu. Wireshark will open a toolbar between the main toolbar and the packet list shown in Figure 6.12, “The “Find Packet” toolbar”. The same toolbar can also search within the currently selected packet: see Section 6.8.2, “Finding Text in the Selected Packet”.

### 6.8.1. The “Find Packet” Toolbar

Figure 6.12. The “Find Packet” toolbar

You can search using the following criteria:

Display filter

  Enter a display filter string into the text entry field and click the Find button. + For example, to find the three-way handshake for a connection from host 192.168.0.1, use the following filter string:

      ip.src==192.168.0.1 and tcp.flags.syn==1

  The value to be found will be syntax checked while you type it in. If the syntax check of your value succeeds, the background of the entry field will turn green, if it fails, it will turn red. For more details see Section 6.3, “Filtering Packets While Viewing”

Hexadecimal Value

  Search for a specific byte sequence in the packet data.

  For example, use “ef:bb:bf” to find the next packet that contains the UTF-8 byte order mark.

String
  Find a string in the packet data, with various options.
Regular Expression
  Search the packet data using Perl-compatible regular expressions. PCRE patterns are beyond the scope of this document, but typing “pcre test” into your favorite search engine should return a number of sites that will help you test and explore your expressions.

### 6.8.2. Finding Text in the Selected Packet

When exactly one packet is selected in the packet list, the "Find Packet" toolbar can search within that packet’s protocol tree instead of searching the whole capture file.

Check Find in selected Packet on the options row at the bottom of the toolbar. Wireshark limits the search type to String and Regular Expression and searches only the packet details of the currently selected packet. The Search in, Multiple occurrences, and Search backward options are not used in this mode.

Enter a search string or regular expression in the search field, then click Find or press Enter to move to the next match. Press Shift+Enter to move to the previous match. You can also use Edit → Find Next (Ctrl+N) and Edit → Find Previous (Ctrl+B). Matching fields are highlighted in the protocol tree.

While a search is active, the status bar can show a match counter such as `[3 of 57]` before the description of the selected field. If no matches are found, Wireshark shows a message in the status bar.

Find in selected Packet is available only when a single packet is selected. If the selection is cleared or includes more than one packet, the checkbox is disabled and any in-packet highlighting is removed. Click Cancel on the toolbar or press Esc to close the Find Packet toolbar and clear the highlighting.

### 6.8.3. Finding Text in the Single-Packet Window

When you view a packet in a separate window (see Figure 6.2, “Viewing a packet in a separate window”), you can search within that window’s protocol tree without using the main Find Packet toolbar.

Check Find in Packet in the row of options below the protocol tree, or select Edit → Find in Packet (Ctrl+Alt+F). Wireshark opens a find bar above the protocol tree. The find bar provides String and Regular Expression search, a Case sensitive option, a match counter, and Find and Cancel buttons.

Enter a search string or regular expression, then click Find or press Enter to move to the next match. Press Shift+Enter to move to the previous match. Matching fields are highlighted in the protocol tree. Uncheck Find in Packet or click Cancel to close the find bar and clear the highlighting.

Prev | Up | Next
6.7. Defining And Saving Filter Macros | Home | 6.9. Go To A Specific Packet