Wireshark · Ethereal-users: [Ethereal-users] Display Filter to Remove an IP Address

["Keith French" <keithfrench@xxxxxxxxxxxxxxx>]

> I am trying to construct a display filter to remove all traffic to and
> from a particular IP address, but all things I try do not work.  What I
> have tried is:-
>
> not ip.addr eq 10.10.10.10
> not (ip.addr eq 10.10.10.10)
> !(ip.addr eq 10.10.10.10)
> ip.addr ne 10.10.10.10

That's odd, as "not (ip.addr eq XXX.XXX.XXX.XXX)" worked for me (it's
equivalent to "!(ip.addr eq XXX.XXX.XXX.XXX)").  I assume that "not
(ip.addr eq 10.10.10.10)" either caused packets to or from 10.10.10.10
to be displayed or caused packets neither to nor from 10.10.10.10 not to
be displayed - which of those, or both, is the case?

What I have found is that if I filter on:-

 

not ether.addr MAC Address

 

it does get rid of the traffic. Some of the packets are broadcasts such as NBNS, but surely that is a layer 3 broadcast, not layer 2?.

 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.689 / Virus Database: 450 - Release Date: 21/05/2004