Question

I am new to wireshark and trying to write simple filters. What i am trying to do is the following: I want to write a filter so that only the packets between my computer and a specified server appear in the packets pane. Here is what i tried:

ip.src==159.20.94.8 and ip.dst==10.1.1.7

First one is the ip address of my computer, and second one is the ip address of the server. But there is also the opposite of this, in which source is the server and destination is my computer.

ip.src==10.1.1.7 and ip.dst==159.20.94.8

So my question is, how can i combine these two filters? Or is there a simpler way for this filtering?

Thanks

Was it helpful?

Solution

Use ip.addr==159.20.94.8 and ip.addr==10.1.1.7

I know that doesn't seem to make sense, but ip.addr matches either source or destination.

OTHER TIPS

Use ip.addr==10.0.0.1 or ip.addr==10.0.0.2.

Using the OR operator will give you results in both ways(Source and Destination).

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top