Ethereal/Wireshark Display Filters

These are filters that I have found useful. You may find them completely useless. Nonetheless, here they are.

Filter out junk & my IP address:

!(dhcpv6) && !nbns && !ssh && !(tcp.port==443) && !(tcp.port==22) && !(http contains GMAIL) && !(http contains gmail) && !(aim.channel == 0x5) && !(ip.addr==192.168.0.100) && !arp && !icmp && !dns && !ipx && !ssl

Find emails with passwords:

(tcp.port eq 110 and tcp.port eq 3457) && (tcp contains PASS)

Find AOL Instant Messenger, but w/o auto-reply:

aim && !(aim.channel == 0x5)

Find emails:

(http contains "hotmail") && (http contains "Reply-To")
WebSanity Top Secret