Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter for Country

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 30, 2009, at 11:28 AM, Gerald Combs wrote:

> Ron Gallimore wrote:
> > Is it possible to create a capture filter to exclude any US IP
> > addresses?  I am using Wireshark 1.1.2 with the GeoIP database  
> > loaded.
>
> You should be able to use something like
>
>    ip and not ip.geoip.country == "United States"
>
> or
>
>    ip.geoip.country and not ip.geoip.country == "United States"

...which works as a display filter, but not a capture filter.