The trick that means you never memorise a field name

3 min read

Three panes: the packet list (one row per frame; Protocol is the highest layer dissected, Info is a human summary worth reading), the detail tree (the packet peeled layer by layer), and the raw bytes.

Here is the move that makes everything else easy: click any field in the detail tree and read the bottom-left of the status bar. It prints that field's filter name — dns.qry.name, tls.handshake.extensions_server_name. You never memorise a cheat sheet; you find the thing once by clicking and Wireshark tells you what to type. Right-click → Apply as Filter → Selected writes it for you; Apply as Column pins it as a column you can read down.

And four menu items do most of the work: Follow → TCP Stream (reassemble one conversation), Statistics → Protocol Hierarchy (what is all this), Statistics → Conversations (who is eating the link), and View → Time Display Format (switch to since-previous-packet so gaps jump out).