Wireshark
the world's foremost network protocol analyzer
Wireshark-users: [Wireshark-users] Wireshark filters
From: "M Holt" <m.iostreams@xxxxxxxxx>
Date: Wed, 10 Sep 2008 20:36:06 -0700
Searched quite a bit on this, but not finding the answer...
When filtering captures in wireshark, is there a way to specify "this address" or "that address"?
Something like:
ip.addr == ( 1.1.1.1 or 2.2.2.2 )
I am looking for something shorter than:
ip.addr == 1.1.1.1 or ip.addr == 2.2.2.2
From tcpdump, I can capture like so:
tcpdump -ni eth0 host \( 1.1.1.1 or 2.2.2.2 \)
thank you in advance,
Michael
When filtering captures in wireshark, is there a way to specify "this address" or "that address"?
Something like:
ip.addr == ( 1.1.1.1 or 2.2.2.2 )
I am looking for something shorter than:
ip.addr == 1.1.1.1 or ip.addr == 2.2.2.2
From tcpdump, I can capture like so:
tcpdump -ni eth0 host \( 1.1.1.1 or 2.2.2.2 \)
thank you in advance,
Michael
- Prev by Date: Re: [Wireshark-users] TCP Window Sizes
- Next by Date: [Wireshark-users] Parsing GSM bits
- Previous by thread: [Wireshark-users] VDX Decode
- Next by thread: [Wireshark-users] Parsing GSM bits
- Index(es):