Wireshark · Display Filter Reference: Internet Protocol Version 4

Field name	Description	Type	Versions
ip.addr	Source or Destination Address	IPv4 address	1.0.0 to 4.4.2
ip.bogus_header_length	Bogus IP header length	Label	3.0.0 to 4.4.2
ip.bogus_ip_length	Bogus IP length	Label	1.12.0 to 4.4.2
ip.bogus_ip_version	Bogus IP version	Label	2.0.0 to 4.4.2
ip.checksum	Header Checksum	Unsigned integer (16 bits)	1.0.0 to 4.4.2
ip.checksum.status	Header checksum status	Unsigned integer (8 bits)	2.2.0 to 4.4.2
ip.checksum_bad	Bad	Boolean	1.0.0 to 2.0.16
ip.checksum_bad.expert	Bad checksum	Label	1.12.0 to 4.4.2
ip.checksum_calculated	Calculated Checksum	Unsigned integer (16 bits)	1.12.0 to 4.4.2
ip.checksum_good	Good	Boolean	1.0.0 to 2.0.16
ip.cipso.categories	Categories	Character string	2.0.0 to 4.4.2
ip.cipso.doi	DOI	Unsigned integer (32 bits)	2.0.0 to 4.4.2
ip.cipso.malformed	Malformed CIPSO tag	Label	2.0.0 to 4.4.2
ip.cipso.sensitivity_level	Sensitivity Level	Unsigned integer (8 bits)	2.0.0 to 4.4.2
ip.cipso.tag_data	Tag data	Byte sequence	2.0.0 to 4.4.2
ip.cipso.tag_type	Tag Type	Unsigned integer (8 bits)	2.0.0 to 4.4.2
ip.cur_rt	Current Route	IPv4 address	1.8.0 to 4.4.2
ip.cur_rt_host	Current Route Host	Character string	1.8.0 to 4.4.2
ip.dsfield	Differentiated Services Field	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.dsfield.ce	ECN-CE	Unsigned integer (8 bits)	1.0.0 to 1.4.15
ip.dsfield.dscp	Differentiated Services Codepoint	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.dsfield.ecn	Explicit Congestion Notification	Unsigned integer (8 bits)	1.6.0 to 4.4.2
ip.dsfield.ect	ECN-Capable Transport (ECT)	Unsigned integer (8 bits)	1.0.0 to 1.4.15
ip.dst	Destination Address	IPv4 address	1.0.0 to 4.4.2
ip.dst_host	Destination Host	Character string	1.0.0 to 4.4.2
ip.empty_rt	Empty Route	IPv4 address	1.8.0 to 4.4.2
ip.empty_rt_host	Empty Route Host	Character string	1.8.0 to 4.4.2
ip.evil_packet	Packet has evil intent	Label	1.12.0 to 4.4.2
ip.flags	Flags	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.flags.df	Don't fragment	Boolean	1.0.0 to 4.4.2
ip.flags.mf	More fragments	Boolean	1.0.0 to 4.4.2
ip.flags.rb	Reserved bit	Boolean	1.0.0 to 4.4.2
ip.flags.sf	Security flag	Boolean	1.4.0 to 4.4.2
ip.frag_offset	Fragment Offset	Unsigned integer (16 bits)	1.0.0 to 4.4.2
ip.fragment	IPv4 Fragment	Frame number	1.0.0 to 4.4.2
ip.fragment.count	Fragment count	Unsigned integer (32 bits)	1.6.0 to 4.4.2
ip.fragment.error	Defragmentation error	Frame number	1.0.0 to 4.4.2
ip.fragment.multipletails	Multiple tail fragments found	Boolean	1.0.0 to 4.4.2
ip.fragment.overlap	Fragment overlap	Boolean	1.0.0 to 4.4.2
ip.fragment.overlap.conflict	Conflicting data in fragment overlap	Boolean	1.0.0 to 4.4.2
ip.fragment.toolongfragment	Fragment too long	Boolean	1.0.0 to 4.4.2
ip.fragments	IPv4 Fragments	Byte sequence	1.0.0 to 4.4.2
ip.geoip.asnum	Source or Destination GeoIP AS Number	Unsigned integer (32 bits)	1.2.1 to 4.4.2
ip.geoip.city	Source or Destination GeoIP City	Character string	1.2.1 to 4.4.2
ip.geoip.country	Source or Destination GeoIP Country	Character string	1.2.1 to 4.4.2
ip.geoip.country_iso	Source or Destination GeoIP ISO Two Letter Country Code	Character string	2.6.0 to 4.4.2
ip.geoip.dst_asnum	Destination GeoIP AS Number	Unsigned integer (32 bits)	1.2.1 to 4.4.2
ip.geoip.dst_city	Destination GeoIP City	Character string	1.2.1 to 4.4.2
ip.geoip.dst_country	Destination GeoIP Country	Character string	1.2.1 to 4.4.2
ip.geoip.dst_country_iso	Destination GeoIP ISO Two Letter Country Code	Character string	2.6.0 to 4.4.2
ip.geoip.dst_isp	Destination GeoIP ISP	Character string	1.2.1 to 2.4.16
ip.geoip.dst_lat	Destination GeoIP Latitude	Floating point (double-precision)	1.2.1 to 4.4.2
ip.geoip.dst_lon	Destination GeoIP Longitude	Floating point (double-precision)	1.2.1 to 4.4.2
ip.geoip.dst_org	Destination GeoIP AS Organization	Character string	1.2.1 to 4.4.2
ip.geoip.dst_summary	Destination GeoIP	Character string	2.6.0 to 4.4.2
ip.geoip.isp	Source or Destination GeoIP ISP	Character string	1.2.1 to 2.4.16
ip.geoip.lat	Source or Destination GeoIP Latitude	Floating point (double-precision)	1.2.1 to 4.4.2
ip.geoip.lon	Source or Destination GeoIP Longitude	Floating point (double-precision)	1.2.1 to 4.4.2
ip.geoip.org	Source or Destination GeoIP AS Organization	Character string	1.2.1 to 4.4.2
ip.geoip.src_asnum	Source GeoIP AS Number	Unsigned integer (32 bits)	1.2.1 to 4.4.2
ip.geoip.src_city	Source GeoIP City	Character string	1.2.1 to 4.4.2
ip.geoip.src_country	Source GeoIP Country	Character string	1.2.1 to 4.4.2
ip.geoip.src_country_iso	Source GeoIP ISO Two Letter Country Code	Character string	2.6.0 to 4.4.2
ip.geoip.src_isp	Source GeoIP ISP	Character string	1.2.1 to 2.4.16
ip.geoip.src_lat	Source GeoIP Latitude	Floating point (double-precision)	1.2.1 to 4.4.2
ip.geoip.src_lon	Source GeoIP Longitude	Floating point (double-precision)	1.2.1 to 4.4.2
ip.geoip.src_org	Source GeoIP AS Organization	Character string	1.2.1 to 4.4.2
ip.geoip.src_summary	Source GeoIP	Character string	2.6.0 to 4.4.2
ip.hdr_len	Header Length	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.host	Source or Destination Host	Character string	1.0.0 to 4.4.2
ip.id	Identification	Unsigned integer (16 bits)	1.0.0 to 4.4.2
ip.len	Total Length	Unsigned integer (16 bits)	1.0.0 to 4.4.2
ip.nop	4 NOP in a row - a router may have removed some options	Label	1.12.0 to 4.4.2
ip.opt.addr	IP Address	IPv4 address	1.8.0 to 4.4.2
ip.opt.deprecated	Option type is deprecated	Label	4.4.0 to 4.4.2
ip.opt.ext_sec_add_sec_info	Additional Security Info	Byte sequence	1.8.0 to 4.4.2
ip.opt.ext_sec_add_sec_info_format_code	Additional Security Info Format Code	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.flag	Flag	Unsigned integer (8 bits)	2.0.0 to 4.4.2
ip.opt.id_number	ID Number	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.len	Length	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.len.invalid	Invalid length for option	Label	1.12.0 to 4.4.2
ip.opt.mtu	MTU	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.ohc	Outbound Hop Count	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.originator	Originator IP Address	IPv4 address	1.8.0 to 4.4.2
ip.opt.overflow	Overflow	Unsigned integer (8 bits)	2.0.0 to 4.4.2
ip.opt.padding	Padding	Byte sequence	1.8.0 to 4.4.2
ip.opt.ptr	Pointer	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.ptr.before_address	Pointer points before first address	Label	1.12.0 to 4.4.2
ip.opt.ptr.middle_address	Pointer points to middle of address	Label	1.12.0 to 4.4.2
ip.opt.qs_func	Function	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.qs_nonce	QS Nonce	Unsigned integer (32 bits)	1.8.0 to 4.4.2
ip.opt.qs_rate	Rate	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.qs_reserved	Reserved	Unsigned integer (32 bits)	1.8.0 to 4.4.2
ip.opt.qs_ttl	QS TTL	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.qs_ttl_diff	TTL Diff	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.qs_unused	Not Used	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.ra	Router Alert	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.rhc	Return Hop Count	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.sec_cl	Classification Level	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_doe	DOE	Boolean	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_flags	Protection Authority Flags	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_fti	Field Termination Indicator	Boolean	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_genser	GENSER	Boolean	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_nsa	NSA	Boolean	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_sci	SCI	Boolean	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_siop_esi	SIOP-ESI	Boolean	1.8.0 to 4.4.2
ip.opt.sec_prot_auth_unassigned	Unassigned	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.sec_rfc791_comp	Compartments	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.sec_rfc791_hr	Handling Restrictions	Character string	1.8.0 to 4.4.2
ip.opt.sec_rfc791_sec	Security	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.sec_rfc791_tcc	Transmission Control Code	Character string	1.8.0 to 4.4.2
ip.opt.sid	Stream Identifier	Unsigned integer (16 bits)	1.8.0 to 4.4.2
ip.opt.time_stamp	Time stamp	Unsigned integer (32 bits)	2.0.0 to 4.4.2
ip.opt.time_stamp_addr	Address	IPv4 address	2.0.0 to 4.4.2
ip.opt.type	Type	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.type.class	Class	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.opt.type.copy	Copy on fragmentation	Boolean	1.8.0 to 4.4.2
ip.opt.type.number	Number	Unsigned integer (8 bits)	1.8.0 to 4.4.2
ip.proto	Protocol	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.reassembled.data	Reassembled IPv4 data	Byte sequence	1.10.0 to 4.4.2
ip.reassembled.length	Reassembled IPv4 length	Unsigned integer (32 bits)	1.4.0 to 4.4.2
ip.reassembled_in	Reassembled IPv4 in frame	Frame number	1.0.0 to 4.4.2
ip.rec_rt	Recorded Route	IPv4 address	1.8.0 to 4.4.2
ip.rec_rt_host	Recorded Route Host	Character string	1.8.0 to 4.4.2
ip.src	Source Address	IPv4 address	1.0.0 to 4.4.2
ip.src_host	Source Host	Character string	1.0.0 to 4.4.2
ip.src_rt	Source Route	IPv4 address	1.8.0 to 4.4.2
ip.src_rt_host	Source Route Host	Character string	1.8.0 to 4.4.2
ip.stream	Stream index	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ip.subopt_too_long	Suboption would go past end of option	Label	1.12.0 to 4.4.2
ip.tos	Type of Service	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.tos.cost	Cost	Boolean	1.0.0 to 4.4.2
ip.tos.delay	Delay	Boolean	1.0.0 to 4.4.2
ip.tos.precedence	Precedence	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.tos.reliability	Reliability	Boolean	1.0.0 to 4.4.2
ip.tos.throughput	Throughput	Boolean	1.0.0 to 4.4.2
ip.ttl	Time to Live	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ip.ttl.lncb	Time To Live	Label	1.12.0 to 4.4.2
ip.ttl.too_small	Time To Live	Label	1.12.0 to 4.4.2
ip.version	Version	Unsigned integer (8 bits)	1.0.0 to 4.4.2