This is our old Q&A Site. Please post any new questions and answers at

I am new to wireshark and would like to know the easiest way of Filtering all traffic coming and going from a specific IP address on out network. any help would be greatly appreciated.

asked 29 Nov '12, 13:34

ksimpson's gravatar image

accept rate: 0%

You can use a capture filter


or a display filter

ip.addr ==

You'll find general information about Wiresahrk in the Wiki.

The following videos might also be interesting:


permanent link

answered 29 Nov '12, 13:55

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 29 Nov '12, 13:57

I have tried that and I am still getting everything not that one specific IP.

(29 Nov '12, 14:00) ksimpson

what exactly did you try?

(29 Nov '12, 15:50) Kurt Knochner ♦

the capture filter then the display filter, I did install wireshark on another machine and got the capture filter to work except it is only showing information from the same vlan as the machine i am wanting to watch.

(30 Nov '12, 09:13) ksimpson

only showing information from the same vlan as the machine i am wanting to watch.

well, that's normal, as you need to setup a proper capturing environment to see traffic of other VLANs and/or other systems.

Basically you need to configure port mirroring on your switch (see link above).

(30 Nov '12, 10:51) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 29 Nov '12, 13:34

question was seen: 409,870 times

last updated: 22 Feb '13, 12:10

p​o​w​e​r​e​d by O​S​Q​A