Wireshark-users: [Wireshark-users] Display Filter for multiple IP's?

From: Richard Biever <rbiever@xxxxxxxxx>
Date: Mon, 05 Mar 2007 17:18:30 -0500

Hello,

This may have been asked before, so apologies if it is a repeat. If I want to filter OUT 1 IP from a Wireshark Capture, I can use the expression:

! ( ip.addr == 10.0.0.1)

However, I would like to filter out multiple IP's from the capture file. I thought doing it like so would work:

! ( ip.addr == 10.0.0.1) or ! ( ip.addr == 10.0.0.2)

But this did not work the way I expected it to.

So, does anyone know how to filter out multiple IP's from a capture file at one time?

Thanks for the help!