Wireshark-users: Re: [Wireshark-users] ip.addr==192.168.0.0/16
Glad that helped. 

You should be able to use the same mask technique in this field as well. At least it seems to work fine for me in a quick test. I used:

snmp.agent_addr == 192.168.0.0/16

and it shows traps from two different /24 networks as expected.

Wes
--- On Mon, 8/10/09, Tony Barratt <[email protected]> wrote:

> From: Tony Barratt <[email protected]>
> Subject: [Wireshark-users] ip.addr==192.168.0.0/16
> To: [email protected]
> Date: Monday, August 10, 2009, 8:58 AM
> Hello Wes,
> 
> Actually that was a very useful hint.
> Because all the traps come from the same place, via a trap
> forwarder I 
> can apply
> snmp.agent_addr  ==192.168.0.0/16 or similar which
> means I can use a 
> couple of subnets and a few IPs and I have a display filter
> to suit.
> Thanks!
> 
> I capture all the traps via tcpdump on a remote box
> (wiresshark install 
> not possible) and UDP port 162 and now I can filter out all
> the traps I 
> am interested in after loading the pcap file into
> wireshark.
> On a related matter if i want to just capture events that
> meet a filter 
> like  snmp.agent_addr  ==192.168.0.0/16 what
> options do I have?
> 
> TIA
> 
> Tony
> > Date: Fri, 7 Aug 2009 06:06:51 -0700 (PDT)
> > From: Wes <[email protected]>
> > Subject: Re: [Wireshark-users] How do I change the
> default capture
> >     filter
> > To: Community support list for Wireshark
> >     <[email protected]>
> > Message-ID: <[email protected]>
> > Content-Type: text/plain; charset=iso-8859-1
> >
> > You might be able to use masks to help narrow it down.
> For example:
> >
> > ip.addr==192.168.0.0/16
> >
> > Wes
> >
> > --- On Fri, 8/7/09, Tony Barratt <[email protected]>
> wrote:
> >
> >   
> >> From: Tony Barratt <[email protected]>
> >> Subject: Re: [Wireshark-users] How do I change the
> default capture filter
> >> To: [email protected]
> >> Date: Friday, August 7, 2009, 3:28 AM
> >> Interesting!
> >> I would like to display filter on 200 known IPs,
> which if
> >> not practical 
> >> in the GUI.
> >> Could I put the filter into one of the dfiles
> found in the
> >> filders tab?
> >> Or is there perhaps a better way?
> >>     
> 
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <[email protected]>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>          
>    mailto:[email protected]?subject=unsubscribe
>