This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Some capture filters do not work in WShark!

0

Hello, Some time ago I used the filter "net" for specific networks eg "192.168.1.0/24 net" and "src" for origin hosts, example : 192.168.1. 100, but none of these work for me now. Have they removed these filters? What is the alternative to these? Thanks in advance!

asked 05 Mar '13, 10:48

zig69's gravatar image

zig69
11336
accept rate: 0%


One Answer:

1

These capture filter do work for me in 1.8.5 (Win XP)

net 192.168.158.0/24
src 192.168.158.139

So, what is your

  • OS
  • OS version
  • Wireshark version

where did you set that capture filter?

Regards
Kurt

answered 05 Mar '13, 10:53

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

OS:Windows XP OS version: Windows XP Service Pack 3 Wireshark version: 1.8.5

I set that capture filters in "filter" field in the main screen and It did not work.I did also from the field "capture file" in the option "show the capture options..." and did not work...

(05 Mar '13, 11:39) zig69

I set that capture filters in "filter" field in the main screen

well, that's the display filter which has a totally different syntax.

I did also from the field "capture file" in the option "show the capture options..." and did not work..

Please see my answer for this question (where are the capture filters in 1.8.x.)

http://ask.wireshark.org/questions/12452/where-are-the-capture-filter-options-in-wireshark-180

(05 Mar '13, 11:42) Kurt Knochner ♦

Thanks for your valuable help.By the way, what is exactly the difference between Display and capture Filters?

(05 Mar '13, 12:03) zig69

http://wiki.wireshark.org/CaptureFilters
Capture filters are used during you capture data.

http://wiki.wireshark.org/DisplayFilters
Display filters are used to analyze/filter the packets in Wireshark after your finished capturing.

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(05 Mar '13, 12:13) Kurt Knochner ♦