I tried dst==192.168.1.101 but only get :
Neither "dst" nor "192.168.1.101" are field or protocol names.
The following display filter isn't a valid display filter:
dst==192.168.1.101
Asked
Active
Viewed 5.6e+01k times
8 Answers
541
Match destination: ip.dst == x.x.x.x
Match source: ip.src == x.x.x.x
Match either: ip.addr == x.x.x.x
The Archetypal Paul
- 41,321
- 20
- 104
- 134
-
`ip.host` have the same effect with `ip.addr`. – Shihe Zhang May 02 '18 at 07:03
42
Filtering IP Address in Wireshark:
(1)single IP filtering:
ip.addr==X.X.X.X
ip.src==X.X.X.X
ip.dst==X.X.X.X
(2)Multiple IP filtering based on logical conditions:
OR condition:
(ip.src==192.168.2.25)||(ip.dst==192.168.2.25)
AND condition:
(ip.src==192.168.2.25) && (ip.dst==74.125.236.16)
Rajeev Das
- 1,581
- 4
- 18
- 21
39
You can also limit the filter to only part of the ip address.
E.G. To filter 123.*.*.* you can use ip.addr == 123.0.0.0/8. Similar effects can be achieved with /16 and /24.
See WireShark man pages (filters) and look for Classless InterDomain Routing (CIDR) notation.
... the number after the slash represents the number of bits used to represent the network.
OldCurmudgeon
- 64,482
- 16
- 119
- 213
18
If you only care about that particular machine's traffic, use a capture filter instead, which you can set under Capture -> Options.
host 192.168.1.101
Wireshark will only capture packet sent to or received by 192.168.1.101. This has the benefit of requiring less processing, which lowers the chances of important packets being dropped (missed).
Dean
- 8,632
- 6
- 45
- 61
-
I saw that on my friends computer as well. The capture filters may have been moved elsewhere in the newer versions of Wireshark. – Dean Jun 22 '13 at 01:24
-
-
2Capture filters can only be built when the capture is stopped. They have to be pre-compiled. Stop the capture and the menu "Capture... Options..." option will be re-enabled. – jdw Sep 01 '13 at 12:28
-
I tried this and was not able to capture packets from a different device connected to the same router. Is there any other way to capture packets of another device connected to the same router using my own laptop? – ABD Aug 23 '21 at 11:06
11
Actually for some reason wireshark uses two different kind of filter syntax one on display filter and other on capture filter. Display filter is only useful to find certain traffic just for display purpose only. its like you are interested in all trafic but for now you just want to see specific.
but if you are interested only in certian traffic and does not care about other at all then you use the capture filter.
The Syntax for display filter is (as mentioned earlier)
ip.addr = x.x.x.x
or
ip.src = x.x.x.x
or
ip.dst = x.x.x.x
but above syntax won't work in capture filters, following are the filters
host x.x.x.x
see more example on wireshark wiki page
fearless_fool
- 33,645
- 23
- 135
- 217
Mubashar
- 12,300
- 11
- 66
- 95
-
This took me a very long time to get used to. It also makes half the advice you can find irrelevant, which is a barrier to entry. :( – Nanban Jim Sep 20 '16 at 19:39
-
3The reason the capture filter uses a different syntax is that it is looking for a pcap filtering expression, which it passes to the underling libpcap library. Libpcap originated out of tcpdump. With Wireshark's more rich understanding of protocols it needed a more rich expression language, so it came up with its own language. – Jim Hoagland Nov 02 '16 at 22:04
1
in our use we have to capture with host x.x.x.x. or (vlan and host x.x.x.x)
anything less will not capture? I am not sure why but that is the way it works!
Jerry
- 11
- 1
-
Because 1) libpcap/WinPcap filters (Wireshark capture filtering is done by libpcap/WinPcap) have limited capabilities and don't check for both VLAN-encapsulated and non-VLAN-encapsulated packets and 2) your network uses VLANs. Unfortunate, but that's the case. – May 28 '14 at 18:13
-2
Other answers already cover how to filter by an address, but if you would like to exclude an address use
ip.addr < 192.168.0.11
Alistair Carscadden
- 1,198
- 5
- 18
tw0z
- 1