A capture shows what reached the observation point. Missing packets may reflect capture loss, asymmetric paths or a filter, rather than network loss.

Quick reference

Task	Display filter	Interpretation
One IPv4 host	ip.addr == 192.0.2.10	Either direction
One IPv6 host	ipv6.addr == 2001:db8::10	Either direction
HTTPS TCP traffic	tcp.port == 443	Does not prove HTTP or decryption
Initial SYN	tcp.flags.syn == 1 && tcp.flags.ack == 0	Connection attempts
Reset	tcp.flags.reset == 1	Inspect sender and timing
DNS query	dns.flags.response == 0	Only decoded DNS
DNS errors	dns.flags.response == 1 && dns.flags.rcode != 0	Error response; inspect code
Retransmission lead	tcp.analysis.retransmission	Analyzer heuristic
Single stream	tcp.stream == 7	Index belongs to this capture

What to understand first

Display filters select packets already in the capture. They do not reduce the original capture file. Use a capture filter only when its narrower acquisition scope is deliberate.

Boolean fields must be compared to their value when checking a flag. tcp.flags.syn tests field presence; tcp.flags.syn == 1 checks whether SYN is set.

TCP analysis marks are derived from observed sequence and timing. Missing capture packets, offload and out-of-order arrival can affect conclusions.

DNS and HTTP filters only work when those protocols are decoded and visible. Encrypted DNS, TLS and QUIC cannot be interpreted as cleartext by merely choosing a port.

Commands and interpretation

Inspection commands are read-only unless explicitly labeled otherwise. Capture commands start collection; configuration-mode commits change device state.

Wireshark display bar

Read-only analysis filters

ip.addr == 192.0.2.10 && tcp.port == 443
tcp.flags.syn == 1 && tcp.flags.ack == 0
tcp.analysis.retransmission || tcp.analysis.fast_retransmission

Inspect: Select the failing tuple first, then inspect sequence, acknowledgment and timing in the full stream.

Conversation triage

Read-only analysis filters

dns.flags.response == 1 && dns.flags.rcode != 0
tcp.flags.reset == 1
tcp.analysis.zero_window

Inspect: An error, reset or zero window needs source identity and surrounding packets to explain it.

Worked example · Illustrative, not a device capture

Illustrative handshake timeline

0.000s Client -> Server: SYN
1.000s Client -> Server: SYN retransmission
3.000s Client -> Server: SYN retransmission
No SYN-ACK observed at this capture point

This shows no observed response here. Check capture completeness, server-side receipt and the return path.

A second authorized capture near the server can distinguish a missing request from a missing reply.

Troubleshooting sequence

Record capture point, interfaces, clock accuracy, tuple and any acquisition filter.
Select the conversation and inspect SYN/SYN-ACK/ACK or the applicable UDP exchange.
Follow the stream and compare failures with a successful attempt under similar conditions.
Correlate retransmissions, resets, windows and response times with endpoint and network logs.
Preserve the original capture; share only the authorized minimum with a clear conclusion and its limits.

Common mistakes

Pasting a display filter into a capture-filter field.
Calling every retransmission flag proof of a bad network.
Inferring no DNS activity from absent cleartext DNS while encrypted DNS is used.

Acceptance checks

Capture includes the relevant directions and interval.
Analysis identifies observations separately from hypotheses.
A repeated application test confirms the corrected behavior.

Primary references

Vendor documentation and protocol specifications support this guide. The diagrams, scenarios and troubleshooting sequences are Wolex-authored.

Wireshark filters by troubleshooting task