Wireshark keyboard shortcuts

Wireshark captures network traffic and lets you inspect every packet in detail. Its keys move between packets and panes, open and save capture files, mark and comment packets, and start or stop captures.

Windows, macOS, Linux · 53 shortcuts

Packet navigation

Move through packet rows, panes, protocol trees, and the packet-selection history.

ActionShortcuts
Move to the next pane
Windows / macOS / LinuxTab
Move to the previous pane
Windows / macOS / LinuxShift + Tab
Select the next packet
Windows / macOS / LinuxDown Arrow
Select the previous packet
Windows / macOS / LinuxUp Arrow
Select the next packet even if the packet list isn't focused
Windows / macOS / LinuxCtrl + Down ArroworF8
Select the previous packet even if the packet list isn't focused
Windows / macOS / LinuxCtrl + Up ArroworF7
Select the next packet in the conversation
Windows / macOS / LinuxCtrl + .
Select the previous packet in the conversation
Windows / macOS / LinuxCtrl + ,
Move forward in packet-selection history
Windows / LinuxAlt + Right Arrow
macOSOption + Right Arrow
Move backward in packet-selection history
Windows / LinuxAlt + Left Arrow
macOSOption + Left Arrow
Close the selected protocol tree
Windows / macOS / LinuxLeft Arrow
Open the selected protocol tree
Windows / macOS / LinuxRight Arrow
Open the selected tree and its subtree
Windows / macOS / LinuxShift + Right Arrow
Expand all protocol trees
Windows / macOS / LinuxCtrl + Right Arrow
Collapse all protocol trees
Windows / macOS / LinuxCtrl + Left Arrow
Move to the parent protocol tree
Windows / macOS / LinuxBackspace
Toggle the selected tree item
Windows / macOS / LinuxEnter

Files and search

Open, save, print, reload, and search capture files from the main window.

ActionShortcuts
Open a capture file
Windows / macOS / LinuxCtrl + O
Close the capture file
Windows / macOS / LinuxCtrl + W
Save the capture file
Windows / macOS / LinuxCtrl + S
Save the capture file as another file
Windows / macOS / LinuxCtrl + Shift + S
Export packet dissections
Windows / macOS / LinuxCtrl + H
Print the capture
Windows / macOS / LinuxCtrl + P
Reload the capture
Windows / macOS / LinuxCtrl + R
Reload the capture as a file
Windows / macOS / LinuxShift + Ctrl + F
Find a packet
Windows / macOS / LinuxCtrl + F
Find the next packet match
Windows / macOS / LinuxCtrl + N
Find the previous packet match
Windows / macOS / LinuxCtrl + B
Go to a packet
Windows / macOS / LinuxCtrl + G
Resize packet-list columns
Windows / macOS / LinuxShift + Ctrl + R

Marks, comments, and references

Mark packets, add time references or comments, and move between those saved points.

ActionShortcuts
Mark or unmark the selected packet
Windows / macOS / LinuxCtrl + M
Mark all packets
Windows / macOS / LinuxCtrl + Shift + M
Unmark all packets
Windows / macOS / LinuxCtrl + Alt + M
Select the next marked packet
Windows / macOS / LinuxCtrl + Shift + N
Select the previous marked packet
Windows / macOS / LinuxCtrl + Shift + B
Ignore the selected packet
Windows / macOS / LinuxCtrl + D
Ignore all packets of the selected type
Windows / macOS / LinuxCtrl + Shift + D
Unignore packets
Windows / macOS / LinuxCtrl + Alt + D
Set or unset a time reference
Windows / macOS / LinuxCtrl + T
Unset all time references
Windows / macOS / LinuxCtrl + Alt + T
Select the next time reference
Windows / macOS / LinuxCtrl + Alt + N
Select the previous time reference
Windows / macOS / LinuxCtrl + Alt + B
Shift packet times
Windows / macOS / LinuxCtrl + Shift + T
Add a packet comment
Windows / macOS / LinuxCtrl + Alt + C

Capture and display

Start capture, open capture options, and control display settings from the keyboard.

ActionShortcuts
Open capture options
Windows / macOS / LinuxCtrl + K
Start or stop a capture
Windows / macOS / LinuxCtrl + E
Refresh capture interfaces
Windows / macOS / LinuxF5
Apply the selected field as a column
Windows / macOS / LinuxShift + Ctrl + I
Open enabled protocols
Windows / macOS / LinuxShift + Ctrl + E
Open configuration profiles
Windows / macOS / LinuxCtrl + Shift + A
Open preferences
Windows / macOS / LinuxCtrl + Shift + P
Open the User's Guide
Windows / macOS / LinuxF1
Quit Wireshark
Windows / macOS / LinuxCtrl + Q

Source

official Wireshark User's Guide · Checked

Current Wireshark User's Guide 4.7.3 checked October 10, 2026. The guide uses the same menu shortcuts across desktop platforms, with Option replacing Alt for packet-selection history on macOS.

Make a printable Wireshark sheet