Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Add Wireshark display filter support

Open
  • Is something wrong?
#97 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@NghiaTranUIT is already working on this.

Since Aug 30, 2026.

Assessment

This issue has not been assessed yet.

Description

DONE enhancement

Description

TCP Viewer has a visual filter builder, but many people already know Wireshark display filters and use them every day.

Add a Wireshark mode to the packet filter panel. A user should be able to type or paste a Wireshark display filter and apply it without exporting the capture or opening another app.

The filter should use TCP Viewer's embedded Wireshark engine. This keeps the syntax and packet results close to Wireshark. The app should check the expression before applying it. If it is invalid, show a useful message, highlight the part that needs fixing, and keep the last working result on screen.

The current Builder mode should stay available for people who prefer the visual controls.

What the filter works with

  • Protocol names such as tcp, udp, dns, http, tls, icmp, arp, and ipv6.
  • Protocol fields such as tcp.port == 443, ip.addr == 192.168.1.10, and http.request.method == "GET".
  • TLS fields, including server names such as tls.handshake.extensions_server_name.
  • Logic with and, or, not, and parentheses.
  • Text and payload checks with contains and matches.
  • Sets, ranges, field slices, and common Wireshark helper functions supported by the embedded Wireshark version.
  • Wireshark columns such as _ws.col.protocol and _ws.col.info.
  • Imported .pcap and .pcapng files.
  • Running and stopped live captures.
  • Existing quick filters and source-list selections.
  • Saved custom filters and TCP Viewer session files, so the expression can be reused later.

Example

tcp.port == 443 and tls.handshake.extensions_server_name contains "example.com"

This should show HTTPS packets whose TLS server name contains example.com.

Related implementation: #95

Dominant language
Swift
Stars
443
Forks
21
Avg merge
10h 42m
Merged PRs (30d)
11

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ProxymanApp/TCPViewer

All issues in ProxymanApp/TCPViewer

Similar issues

More Swift issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.