Essential Wireshark Display Filters
A cheat sheet of the display filters used most often in triage.
Display filters narrow down a capture without discarding packets, unlike capture filters which are applied at capture time.
ip.addr == 10.0.0.1
tcp.flags.syn == 1 && tcp.flags.ack == 0
http.request.method == "POST"
Combining filters with && and || lets you isolate a single conversation or a specific type of anomaly quickly.