Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter for Country

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 30, 2009, at 10:47 AM, Ron Gallimore wrote:

> Is it possible to create a capture filter to exclude any US IP
> addresses?

Not from within Wireshark, no.  It has no code to do that.

You might be able to find address range information at ARIN's Web  
site; hopefully they distinguish between US and Canadian/assorted  
islands range allocation.  Hopefully any capture filter you construct  
from that won't result in a BPF program too big to put into the kernel.