You might assume that the packets on your network have one IPv4 header and therefore one source address, but that’s not necessarily the case. Within Wireshark that means using the “ip.src” filter field. Suppose you want to filter on an IPv4 source address. These improvements give you more control over the way that multiple occurrences of the same field are handled, let you do arithmetic, and many other things.įirst, let’s look at the way multiple field occurrences are handled. Display Filter Changesĭisplay filters are one of Wireshark’s defining features and 4.0 makes them more powerful and more consistent. I’ll cover some highlights here, but the release notes go into much greater detail. If you are a regular Wireshark user we recommend that you pay close attention to the release notes this time around, since it includes quite a few changes. Wireshark 4.0 was released today, and as you might have guessed from the version number, quite a few things have changed since 3.6.

Wireshark https display filter