This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, Some time ago I used the filter "net" for specific networks eg "192.168.1.0/24 net" and "src" for origin hosts, example : 192.168.1. 100, but none of these work for me now. Have they removed these filters? What is the alternative to these? Thanks in advance!

asked 05 Mar '13, 10:48

zig69's gravatar image

zig69
11336
accept rate: 0%


These capture filter do work for me in 1.8.5 (Win XP)

net 192.168.158.0/24
src 192.168.158.139

So, what is your

  • OS
  • OS version
  • Wireshark version

where did you set that capture filter?

Regards
Kurt

permanent link

answered 05 Mar '13, 10:53

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

OS:Windows XP OS version: Windows XP Service Pack 3 Wireshark version: 1.8.5

I set that capture filters in "filter" field in the main screen and It did not work.I did also from the field "capture file" in the option "show the capture options..." and did not work...

(05 Mar '13, 11:39) zig69

I set that capture filters in "filter" field in the main screen

well, that's the display filter which has a totally different syntax.

I did also from the field "capture file" in the option "show the capture options..." and did not work..

Please see my answer for this question (where are the capture filters in 1.8.x.)

http://ask.wireshark.org/questions/12452/where-are-the-capture-filter-options-in-wireshark-180

(05 Mar '13, 11:42) Kurt Knochner ♦

Thanks for your valuable help.By the way, what is exactly the difference between Display and capture Filters?

(05 Mar '13, 12:03) zig69

http://wiki.wireshark.org/CaptureFilters
Capture filters are used during you capture data.

http://wiki.wireshark.org/DisplayFilters
Display filters are used to analyze/filter the packets in Wireshark after your finished capturing.

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(05 Mar '13, 12:13) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×184
×165

question asked: 05 Mar '13, 10:48

question was seen: 2,193 times

last updated: 05 Mar '13, 12:14

p​o​w​e​r​e​d by O​S​Q​A