How to filter by IP address in Wireshark?

StackOverflow https://stackoverflow.com/questions/4043406

  •  27-09-2019
  •  | 
  •  

Question

I tried dst==192.168.1.101 but only get :

Neither "dst" nor "192.168.1.101" are field or protocol names.

The following display filter isn't a valid display filter:
dst==192.168.1.101
Was it helpful?

Solution

Match destination: ip.dst == x.x.x.x

Match source: ip.src == x.x.x.x

Match either: ip.addr == x.x.x.x

OTHER TIPS

Filtering IP Address in Wireshark:

(1)single IP filtering:

ip.addr==X.X.X.X

ip.src==X.X.X.X

ip.dst==X.X.X.X

(2)Multiple IP filtering based on logical conditions:

OR condition:

(ip.src==192.168.2.25)||(ip.dst==192.168.2.25)

AND condition:

(ip.src==192.168.2.25) && (ip.dst==74.125.236.16)

You can also limit the filter to only part of the ip address.

E.G. To filter 123.*.*.* you can use ip.addr == 123.0.0.0/8. Similar effects can be achieved with /16 and /24.

See WireShark man pages (filters) and look for Classless InterDomain Routing (CIDR) notation.

... the number after the slash represents the number of bits used to represent the network.

If you only care about that particular machine's traffic, use a capture filter instead, which you can set under Capture -> Options. 

host 192.168.1.101

Wireshark will only capture packet sent to or received by 192.168.1.101. This has the benefit of requiring less processing, which lowers the chances of important packets being dropped (missed).

Try

ip.dst == 172.16.3.255

Actually for some reason wireshark uses two different kind of filter syntax one on display filter and other on capture filter. Display filter is only useful to find certain traffic just for display purpose only. its like you are interested in all trafic but for now you just want to see specific.

but if you are interested only in certian traffic and does not care about other at all then you use the capture filter.

The Syntax for display filter is (as mentioned earlier)

ip.addr = x.x.x.x or ip.src = x.x.x.x or ip.dst = x.x.x.x

but above syntax won't work in capture filters, following are the filters

host x.x.x.x

see more example on wireshark wiki page

in our use we have to capture with host x.x.x.x. or (vlan and host x.x.x.x)

anything less will not capture? I am not sure why but that is the way it works!

Try write out in filter string: ip.dst == x.x.x.x

Other answers already cover how to filter by an address, but if you would like to exclude an address use

ip.addr < 192.168.0.11

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top