Ron Gallimore wrote:
> Is it possible to create a capture filter to exclude any US IP
> addresses? I am using Wireshark 1.1.2 with the GeoIP database loaded.
You should be able to use something like
ip and not ip.geoip.country == "United States"
or
ip.geoip.country and not ip.geoip.country == "United States"
The first filter will match any non-US IP packet including those that GeoIP
doesn't have country information for such as RFC 1918 private addresses. The
second filter will exclude everything GeoIP doesn't have country information
for, as well as US traffic.
--
Join us for Sharkfest’09 | Stanford University, June 15 – 18
http://www.cacetech.com/sharkfest.09/
