Display Filter References
https://www.wireshark.org/docs/dfref/
Variables : == != or && and not | “with”
tcp.
udp.
ip.src
ip.dst
tcp.windows_size == 0 && tcp.flags.reset !=1
frame.len<1500
http
sip.
icmp
ip.src in {192.168.10.1 8.8.8.8}
tcp in {80 443 8080}
(icmp and ip.scr==8.8.8.8) || dns
ip.addr == 10.10.10.10 || ip.addr == 20.20.20.20 is the same as :
ip.addr in {20.20.20.20 10.10.10.10}
ip.addr == 192.168.1.0/24
