Which display filter filters traffic to the host 1.2.3.4 on port 443?

• A. ip.addr == 1.2.3.4 && tcp.dstport == 22
• B. ip.addr == 1.2.3.4 && tcp.dstport == 443
• C. ip.addr == 4.3.2.1 && tcp.dstport == 443
• D. ip.addr == 1.2.3.4 && tcp.dstport == 80

Answer: (B)

In Wireshark display filters, to see traffic aimed at a specific host on a specific port, combine an IP match with a port match using a logical AND. The filter ip.addr == 1.2.3.4 matches any packet that has that IP in either the source or destination field. Pairing that with tcp.dstport == 443 narrows it to packets whose destination TCP port is 443. Together, they select traffic destined for 1.2.3.4 on port 443, i.e., HTTPS traffic to that host. The other options would filter for different ports or a different IP, so they don’t match the described scenario.