Join us 4-8 November in Vienna for SharkFest'24 EUROPE, the official Wireshark Developer and User Conference
Wireshark logo

Display Filter Reference: Internet Protocol Version 4

Protocol field name: ip

Versions: 1.0.0 to 4.4.1

Back to Display Filter Reference

Field name Description Type Versions
ip.addrSource or Destination AddressIPv4 address1.0.0 to 4.4.1
ip.bogus_header_lengthBogus IP header lengthLabel3.0.0 to 4.4.1
ip.bogus_ip_lengthBogus IP lengthLabel1.12.0 to 4.4.1
ip.bogus_ip_versionBogus IP versionLabel2.0.0 to 4.4.1
ip.checksumHeader ChecksumUnsigned integer (16 bits)1.0.0 to 4.4.1
ip.checksum.statusHeader checksum statusUnsigned integer (8 bits)2.2.0 to 4.4.1
ip.checksum_badBadBoolean1.0.0 to 2.0.16
ip.checksum_bad.expertBad checksumLabel1.12.0 to 4.4.1
ip.checksum_calculatedCalculated ChecksumUnsigned integer (16 bits)1.12.0 to 4.4.1
ip.checksum_goodGoodBoolean1.0.0 to 2.0.16
ip.cipso.categoriesCategoriesCharacter string2.0.0 to 4.4.1
ip.cipso.doiDOIUnsigned integer (32 bits)2.0.0 to 4.4.1
ip.cipso.malformedMalformed CIPSO tagLabel2.0.0 to 4.4.1
ip.cipso.sensitivity_levelSensitivity LevelUnsigned integer (8 bits)2.0.0 to 4.4.1
ip.cipso.tag_dataTag dataByte sequence2.0.0 to 4.4.1
ip.cipso.tag_typeTag TypeUnsigned integer (8 bits)2.0.0 to 4.4.1
ip.cur_rtCurrent RouteIPv4 address1.8.0 to 4.4.1
ip.cur_rt_hostCurrent Route HostCharacter string1.8.0 to 4.4.1
ip.dsfieldDifferentiated Services FieldUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.dsfield.ceECN-CEUnsigned integer (8 bits)1.0.0 to 1.4.15
ip.dsfield.dscpDifferentiated Services CodepointUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.dsfield.ecnExplicit Congestion NotificationUnsigned integer (8 bits)1.6.0 to 4.4.1
ip.dsfield.ectECN-Capable Transport (ECT)Unsigned integer (8 bits)1.0.0 to 1.4.15
ip.dstDestination AddressIPv4 address1.0.0 to 4.4.1
ip.dst_hostDestination HostCharacter string1.0.0 to 4.4.1
ip.empty_rtEmpty RouteIPv4 address1.8.0 to 4.4.1
ip.empty_rt_hostEmpty Route HostCharacter string1.8.0 to 4.4.1
ip.evil_packetPacket has evil intentLabel1.12.0 to 4.4.1
ip.flagsFlagsUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.flags.dfDon't fragmentBoolean1.0.0 to 4.4.1
ip.flags.mfMore fragmentsBoolean1.0.0 to 4.4.1
ip.flags.rbReserved bitBoolean1.0.0 to 4.4.1
ip.flags.sfSecurity flagBoolean1.4.0 to 4.4.1
ip.frag_offsetFragment OffsetUnsigned integer (16 bits)1.0.0 to 4.4.1
ip.fragmentIPv4 FragmentFrame number1.0.0 to 4.4.1
ip.fragment.countFragment countUnsigned integer (32 bits)1.6.0 to 4.4.1
ip.fragment.errorDefragmentation errorFrame number1.0.0 to 4.4.1
ip.fragment.multipletailsMultiple tail fragments foundBoolean1.0.0 to 4.4.1
ip.fragment.overlapFragment overlapBoolean1.0.0 to 4.4.1
ip.fragment.overlap.conflictConflicting data in fragment overlapBoolean1.0.0 to 4.4.1
ip.fragment.toolongfragmentFragment too longBoolean1.0.0 to 4.4.1
ip.fragmentsIPv4 FragmentsByte sequence1.0.0 to 4.4.1
ip.geoip.asnumSource or Destination GeoIP AS NumberUnsigned integer (32 bits)1.2.1 to 4.4.1
ip.geoip.citySource or Destination GeoIP CityCharacter string1.2.1 to 4.4.1
ip.geoip.countrySource or Destination GeoIP CountryCharacter string1.2.1 to 4.4.1
ip.geoip.country_isoSource or Destination GeoIP ISO Two Letter Country CodeCharacter string2.6.0 to 4.4.1
ip.geoip.dst_asnumDestination GeoIP AS NumberUnsigned integer (32 bits)1.2.1 to 4.4.1
ip.geoip.dst_cityDestination GeoIP CityCharacter string1.2.1 to 4.4.1
ip.geoip.dst_countryDestination GeoIP CountryCharacter string1.2.1 to 4.4.1
ip.geoip.dst_country_isoDestination GeoIP ISO Two Letter Country CodeCharacter string2.6.0 to 4.4.1
ip.geoip.dst_ispDestination GeoIP ISPCharacter string1.2.1 to 2.4.16
ip.geoip.dst_latDestination GeoIP LatitudeFloating point (double-precision)1.2.1 to 4.4.1
ip.geoip.dst_lonDestination GeoIP LongitudeFloating point (double-precision)1.2.1 to 4.4.1
ip.geoip.dst_orgDestination GeoIP AS OrganizationCharacter string1.2.1 to 4.4.1
ip.geoip.dst_summaryDestination GeoIPCharacter string2.6.0 to 4.4.1
ip.geoip.ispSource or Destination GeoIP ISPCharacter string1.2.1 to 2.4.16
ip.geoip.latSource or Destination GeoIP LatitudeFloating point (double-precision)1.2.1 to 4.4.1
ip.geoip.lonSource or Destination GeoIP LongitudeFloating point (double-precision)1.2.1 to 4.4.1
ip.geoip.orgSource or Destination GeoIP AS OrganizationCharacter string1.2.1 to 4.4.1
ip.geoip.src_asnumSource GeoIP AS NumberUnsigned integer (32 bits)1.2.1 to 4.4.1
ip.geoip.src_citySource GeoIP CityCharacter string1.2.1 to 4.4.1
ip.geoip.src_countrySource GeoIP CountryCharacter string1.2.1 to 4.4.1
ip.geoip.src_country_isoSource GeoIP ISO Two Letter Country CodeCharacter string2.6.0 to 4.4.1
ip.geoip.src_ispSource GeoIP ISPCharacter string1.2.1 to 2.4.16
ip.geoip.src_latSource GeoIP LatitudeFloating point (double-precision)1.2.1 to 4.4.1
ip.geoip.src_lonSource GeoIP LongitudeFloating point (double-precision)1.2.1 to 4.4.1
ip.geoip.src_orgSource GeoIP AS OrganizationCharacter string1.2.1 to 4.4.1
ip.geoip.src_summarySource GeoIPCharacter string2.6.0 to 4.4.1
ip.hdr_lenHeader LengthUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.hostSource or Destination HostCharacter string1.0.0 to 4.4.1
ip.idIdentificationUnsigned integer (16 bits)1.0.0 to 4.4.1
ip.lenTotal LengthUnsigned integer (16 bits)1.0.0 to 4.4.1
ip.nop4 NOP in a row - a router may have removed some optionsLabel1.12.0 to 4.4.1
ip.opt.addrIP AddressIPv4 address1.8.0 to 4.4.1
ip.opt.deprecatedOption type is deprecatedLabel4.4.0 to 4.4.1
ip.opt.ext_sec_add_sec_infoAdditional Security InfoByte sequence1.8.0 to 4.4.1
ip.opt.ext_sec_add_sec_info_format_codeAdditional Security Info Format CodeUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.flagFlagUnsigned integer (8 bits)2.0.0 to 4.4.1
ip.opt.id_numberID NumberUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.lenLengthUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.len.invalidInvalid length for optionLabel1.12.0 to 4.4.1
ip.opt.mtuMTUUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.ohcOutbound Hop CountUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.originatorOriginator IP AddressIPv4 address1.8.0 to 4.4.1
ip.opt.overflowOverflowUnsigned integer (8 bits)2.0.0 to 4.4.1
ip.opt.paddingPaddingByte sequence1.8.0 to 4.4.1
ip.opt.ptrPointerUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.ptr.before_addressPointer points before first addressLabel1.12.0 to 4.4.1
ip.opt.ptr.middle_addressPointer points to middle of addressLabel1.12.0 to 4.4.1
ip.opt.qs_funcFunctionUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.qs_nonceQS NonceUnsigned integer (32 bits)1.8.0 to 4.4.1
ip.opt.qs_rateRateUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.qs_reservedReservedUnsigned integer (32 bits)1.8.0 to 4.4.1
ip.opt.qs_ttlQS TTLUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.qs_ttl_diffTTL DiffUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.qs_unusedNot UsedUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.raRouter AlertUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.rhcReturn Hop CountUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.sec_clClassification LevelUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.sec_prot_auth_doeDOEBoolean1.8.0 to 4.4.1
ip.opt.sec_prot_auth_flagsProtection Authority FlagsUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.sec_prot_auth_ftiField Termination IndicatorBoolean1.8.0 to 4.4.1
ip.opt.sec_prot_auth_genserGENSERBoolean1.8.0 to 4.4.1
ip.opt.sec_prot_auth_nsaNSABoolean1.8.0 to 4.4.1
ip.opt.sec_prot_auth_sciSCIBoolean1.8.0 to 4.4.1
ip.opt.sec_prot_auth_siop_esiSIOP-ESIBoolean1.8.0 to 4.4.1
ip.opt.sec_prot_auth_unassignedUnassignedUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.sec_rfc791_compCompartmentsUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.sec_rfc791_hrHandling RestrictionsCharacter string1.8.0 to 4.4.1
ip.opt.sec_rfc791_secSecurityUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.sec_rfc791_tccTransmission Control CodeCharacter string1.8.0 to 4.4.1
ip.opt.sidStream IdentifierUnsigned integer (16 bits)1.8.0 to 4.4.1
ip.opt.time_stampTime stampUnsigned integer (32 bits)2.0.0 to 4.4.1
ip.opt.time_stamp_addrAddressIPv4 address2.0.0 to 4.4.1
ip.opt.typeTypeUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.type.classClassUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.opt.type.copyCopy on fragmentationBoolean1.8.0 to 4.4.1
ip.opt.type.numberNumberUnsigned integer (8 bits)1.8.0 to 4.4.1
ip.protoProtocolUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.reassembled.dataReassembled IPv4 dataByte sequence1.10.0 to 4.4.1
ip.reassembled.lengthReassembled IPv4 lengthUnsigned integer (32 bits)1.4.0 to 4.4.1
ip.reassembled_inReassembled IPv4 in frameFrame number1.0.0 to 4.4.1
ip.rec_rtRecorded RouteIPv4 address1.8.0 to 4.4.1
ip.rec_rt_hostRecorded Route HostCharacter string1.8.0 to 4.4.1
ip.srcSource AddressIPv4 address1.0.0 to 4.4.1
ip.src_hostSource HostCharacter string1.0.0 to 4.4.1
ip.src_rtSource RouteIPv4 address1.8.0 to 4.4.1
ip.src_rt_hostSource Route HostCharacter string1.8.0 to 4.4.1
ip.streamStream indexUnsigned integer (32 bits)4.4.0 to 4.4.1
ip.subopt_too_longSuboption would go past end of optionLabel1.12.0 to 4.4.1
ip.tosType of ServiceUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.tos.costCostBoolean1.0.0 to 4.4.1
ip.tos.delayDelayBoolean1.0.0 to 4.4.1
ip.tos.precedencePrecedenceUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.tos.reliabilityReliabilityBoolean1.0.0 to 4.4.1
ip.tos.throughputThroughputBoolean1.0.0 to 4.4.1
ip.ttlTime to LiveUnsigned integer (8 bits)1.0.0 to 4.4.1
ip.ttl.lncbTime To LiveLabel1.12.0 to 4.4.1
ip.ttl.too_smallTime To LiveLabel1.12.0 to 4.4.1
ip.versionVersionUnsigned integer (8 bits)1.0.0 to 4.4.1