8

I am looking for filter out the TCP[RST] packets on wireshark. I have tried tcp.analysis.flag but it didn't help.

2 Answers 2

11

tcp.flags.reset==1 [displays all TCP resets]

for more flags

0

Also if you ever want to filter a certain filter like this go to the middle pane and then go to the actual line it says what you want to filter. (In this example the reset flag) Click that it will highlight it. Something to note once it is highlighted it will show you the filter to search for in the lower left hand corner.(tcp.flags.reset) If you right click the highlighted section now you can click on filter and you have some options there. You can search selected (== or eq) not selected (!) and selected (&&) or selected (||) and of course the not versions to the and and or. Once you click on your choice it will be placed in the filter bar the way you chose. I hope this helps its a really nice feature.

1
  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Nov 10, 2023 at 18:19

You must log in to answer this question.