Wireshark keyboard shortcuts

Move through packet rows, panes, protocol trees, and the packet-selection history.

Action	Windows	macOS	Linux
Move to the next pane	`Tab`	`Tab`	`Tab`
Move to the previous pane	`ShiftTab`	`ShiftTab`	`ShiftTab`
Select the next packet	`Down Arrow`	`Down Arrow`	`Down Arrow`
Select the previous packet	`Up Arrow`	`Up Arrow`	`Up Arrow`
Select the next packet	`CtrlDown Arrow`	`CtrlDown Arrow`	`CtrlDown Arrow`
Select the previous packet	`CtrlUp Arrow`	`CtrlUp Arrow`	`CtrlUp Arrow`
Select the next packet in the conversation	`Ctrl.`	`Ctrl.`	`Ctrl.`
Select the previous packet in the conversation	`Ctrl,`	`Ctrl,`	`Ctrl,`
Move forward in packet-selection history	`AltRight Arrow`	`OptionRight Arrow`	`AltRight Arrow`
Move backward in packet-selection history	`AltLeft Arrow`	`OptionLeft Arrow`	`AltLeft Arrow`
Close the selected protocol tree	`Left Arrow`	`Left Arrow`	`Left Arrow`
Open the selected protocol tree	`Right Arrow`	`Right Arrow`	`Right Arrow`
Open the selected tree and its subtree	`ShiftRight Arrow`	`ShiftRight Arrow`	`ShiftRight Arrow`
Expand all protocol trees	`CtrlRight Arrow`	`CtrlRight Arrow`	`CtrlRight Arrow`
Collapse all protocol trees	`CtrlLeft Arrow`	`CtrlLeft Arrow`	`CtrlLeft Arrow`
Move to the parent protocol tree	`Backspace`	`Backspace`	`Backspace`
Toggle the selected tree item	`Enter`	`Enter`	`Enter`

Files and search

Open, save, print, reload, and search capture files from the main window.

Action	Windows	macOS	Linux
Open a capture file	`CtrlO`	`CtrlO`	`CtrlO`
Close the capture file	`CtrlW`	`CtrlW`	`CtrlW`
Save the capture file	`CtrlS`	`CtrlS`	`CtrlS`
Save the capture file as another file	`CtrlShiftS`	`CtrlShiftS`	`CtrlShiftS`
Export packet dissections	`CtrlH`	`CtrlH`	`CtrlH`
Print the capture	`CtrlP`	`CtrlP`	`CtrlP`
Reload the capture	`CtrlR`	`CtrlR`	`CtrlR`
Reload the capture as a file	`ShiftCtrlF`	`ShiftCtrlF`	`ShiftCtrlF`
Find a packet	`CtrlF`	`CtrlF`	`CtrlF`
Find the next packet match	`CtrlN`	`CtrlN`	`CtrlN`
Find the previous packet match	`CtrlB`	`CtrlB`	`CtrlB`
Go to a packet	`CtrlG`	`CtrlG`	`CtrlG`
Resize packet-list columns	`ShiftCtrlR`	`ShiftCtrlR`	`ShiftCtrlR`

Mark packets, add time references or comments, and move between those saved points.

Action	Windows	macOS	Linux
Mark or unmark the selected packet	`CtrlM`	`CtrlM`	`CtrlM`
Mark all packets	`CtrlShiftM`	`CtrlShiftM`	`CtrlShiftM`
Unmark all packets	`CtrlAltM`	`CtrlAltM`	`CtrlAltM`
Select the next marked packet	`CtrlShiftN`	`CtrlShiftN`	`CtrlShiftN`
Select the previous marked packet	`CtrlShiftB`	`CtrlShiftB`	`CtrlShiftB`
Ignore the selected packet	`CtrlD`	`CtrlD`	`CtrlD`
Ignore all packets of the selected type	`CtrlShiftD`	`CtrlShiftD`	`CtrlShiftD`
Unignore packets	`CtrlAltD`	`CtrlAltD`	`CtrlAltD`
Set or unset a time reference	`CtrlT`	`CtrlT`	`CtrlT`
Unset all time references	`CtrlAltT`	`CtrlAltT`	`CtrlAltT`
Select the next time reference	`CtrlAltN`	`CtrlAltN`	`CtrlAltN`
Select the previous time reference	`CtrlAltB`	`CtrlAltB`	`CtrlAltB`
Shift packet times	`CtrlShiftT`	`CtrlShiftT`	`CtrlShiftT`
Add a packet comment	`CtrlAltC`	`CtrlAltC`	`CtrlAltC`

Start capture, open capture options, and control display settings from the keyboard.

Action	Windows	macOS	Linux
Open capture options	`CtrlK`	`CtrlK`	`CtrlK`
Start or stop a capture	`CtrlE`	`CtrlE`	`CtrlE`
Refresh capture interfaces	`F5`	`F5`	`F5`
Apply the selected field as a column	`ShiftCtrlI`	`ShiftCtrlI`	`ShiftCtrlI`
Open enabled protocols	`ShiftCtrlE`	`ShiftCtrlE`	`ShiftCtrlE`
Open configuration profiles	`CtrlShiftA`	`CtrlShiftA`	`CtrlShiftA`
Open preferences	`CtrlShiftP`	`CtrlShiftP`	`CtrlShiftP`
Open the User's Guide	`F1`	`F1`	`F1`
Quit Wireshark	`CtrlQ`	`CtrlQ`	`CtrlQ`