Question

how to apply filter on an existing .cap file ? so i have a .cap file and want to filter out one particular IP , what is the command for that . I am using wireshark .

Thanks

Was it helpful?

Solution

ip.addr == 127.15.16.13

Sometimes you may need ip.src == ..... or ip.dst == ...

After that you may save filtered packets by selecting File->Save As->Packet Range->Displayed

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top