Wireshark-users: Re: [Wireshark-users] Display Filter for multiple IP's?

From: "Luis Ontanon" <luis.ontanon@xxxxxxxxx>
Date: Mon, 5 Mar 2007 23:27:04 +0100

! (ip.addr == 10.1.1.1  or ip.addr == 10.2.2.2 or ip.addr == 10.3.3.3 )

On 3/5/07, Richard Biever <rbiever@xxxxxxxxx> wrote:

Hello,

This may have been asked before, so apologies if it is a repeat.  If I
want to filter OUT 1 IP from a Wireshark Capture, I can use the expression:

! ( ip.addr == 10.0.0.1)

However, I would like to filter out multiple IP's from the capture
file.  I thought doing it like so would work:


! ( ip.addr == 10.0.0.1) or ! ( ip.addr == 10.0.0.2)

But this did not work the way I expected it to.

So, does anyone know how to filter out multiple IP's from a capture file
at one time?

Thanks for the help!

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan