On Monday 03 March 2014 16:25:06 我想不无聊 wrote:
> I just captured WLAN packets with wireshark, I want to display the packets
> whose source address is 10.0.1.128 ,what is the display filter
> expression?thanks.
The manual page of wireshark-filter(4) has an example for this. Adapter for
your case:
ip.src == 10.0.1.128
If you only need packets from this IP, consider setting a capture filter.
dumpcap -i eth0 -w capture.pcapng -f 'host 10.0.1.128'
Or if you only care about packets originating from that IP:
dumpcap -i eth0 -w capture.pcapng -f 'src host 10.0.1.128'
(see manual page of pcap-filter(7)).
Peter
