To view only IPsec ESP packets in Wireshark, which display filter would you use?

• A. ip.proto == 50
• B. tcp.port == 80
• C. udp.port == 53
• D. ip.src == 10.0.0.1

Answer: (A)

IPsec ESP is identified in the IP header by the protocol number 50. Filtering with ip.proto == 50 shows only packets where the IP header’s protocol field equals 50, which corresponds to ESP. ESP doesn’t use TCP or UDP ports, so filters like tcp.port or udp.port wouldn’t capture ESP traffic, and filtering by a source IP narrows by who sent the packet rather than by the protocol. So this filter is the correct way to view only ESP packets.