This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

duplicate IP address display filter

0

In expert info, I have found two warnings about duplicate IP addresses. Ofcourse, the customer thinks I'm crazy ("Not on my network!") so I took some screenshots showing his this. The only way I was able to show him both in the same screen was to build the filter using the "or" for both IP address warns. expert.message == "Duplicate IP address configured (192.168.0.23)"

Is there a way to create the filter just on duplicates in general without having to spell each IP out?

Thanks

asked 01 Jun '12, 08:30

EricKnaus's gravatar image

EricKnaus
46192026
accept rate: 0%


One Answer:

0

Yes. Use the "contains" operator to match the part of the expert info message that doesn't have the IP address. Try this display filter:

expert.message contains "Duplicate IP address"

answered 01 Jun '12, 08:41

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Jim - Thanks!

(01 Jun '12, 13:27) EricKnaus