This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display Filter

0

I've created list of ip.dst, with I do not need to view, using command "Apply as Filter - and not selected" by context menu: here it is:

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((!(ip.dst == 213.155.152.137)) && !(ip.dst == 192.168.1.1)) && !(ip.dst == 192.168.1.3)) && !(ip.dst == 31.170.163.90)) && !(ip.dst == 31.170.164.249)) && !(ip.dst == 213.155.152.160)) && !(ip.dst == 173.194.40.24)) && !(ip.dst == 173.194.39.87)) && !(ip.dst == 173.194.39.175)) && !(ip.dst == 80.239.149.82)) && !(ip.dst == 212.96.161.239)) && !(ip.dst == 213.155.152.152)) && !(ip.dst == 204.193.144.15)) && !(ip.dst == 69.195.141.179)) && !(ip.dst == 72.167.239.239)) && !(ip.dst == 50.16.244.106)) && !(ip.dst == 74.125.232.151)) && !(ip.dst == 173.194.39.95)) && !(ip.dst == 213.155.152.153)) && !(ip.dst == 199.7.51.72)) && !(ip.dst == 173.194.39.133)) && !(ip.dst == 193.27.49.165)) && !(ip.dst == 173.194.39.132)) && !(ip.dst == 88.198.249.37)) && !(ip.dst == 81.19.88.106)) && !(ip.dst == 81.19.66.97)) && !(ip.dst == 217.69.135.130)) && !(ip.dst == 63.245.217.112)) && !(ip.dst == 199.7.55.72)) && !(ip.dst == 95.132.144.97)) && !(ip.dst == 93.184.220.20)) && !(ip.dst == 109.234.156.37)) && !(ip.dst == 217.69.133.147)) && !(ip.dst == 81.19.88.95)) && !(ip.dst == 5.153.25.5)) && !(ip.dst == 173.194.39.98)) && !(ip.dst == 88.212.196.105)) && !(ip.dst == 217.69.141.58)) && !(ip.dst == 173.194.39.105)) && !(ip.dst == 95.67.113.6)) && !(ip.dst == 173.194.39.71)) && !(ip.dst == 88.212.196.122)) && !(ip.dst == 173.194.39.70)) && !(ip.dst == 173.194.39.143)) && !(ip.dst == 217.69.141.43)) && !(ip.dst == 173.194.39.174)) && !(ip.dst == 173.194.39.134)) && !(ip.dst == 94.100.180.199)) && !(ip.dst == 94.100.187.33)) && !(ip.dst == 88.212.196.75)) && !(ip.dst == 173.194.39.129)) && !(ip.dst == 173.194.39.72)) && !(ip.dst == 173.194.39.110)) && !(ip.dst == 31.170.160.65)) && !(ip.dst == 78.108.183.161)) && !(ip.dst == 74.125.232.152)) && !(ip.dst == 173.194.39.135)) && !(ip.dst == 74.125.108.115)) && !(ip.dst == 173.194.21.26)) && !(ip.dst == 173.194.39.164)) && !(ip.dst == 173.194.39.97)) && !(ip.dst == 173.194.33.15)) && !(ip.dst == 173.194.39.104)) && !(ip.dst == 173.194.39.130)) && !(ip.dst == 74.125.108.202)) && !(ip.dst == 173.194.39.142)) && !(ip.dst == 74.125.108.14)) && !(ip.dst == 82.144.193.240)) && !(ip.dst == 87.250.250.119)) && !(ip.dst == 173.194.39.100)) && !(ip.dst == 173.194.39.162)) && !(ip.dst == 173.194.39.79)) && !(ip.dst == 23.64.212.61)) && !(ip.dst == 74.125.232.159)) && !(ip.dst == 173.194.39.190)) && !(ip.dst == 63.245.217.50)) && !(ip.dst == 173.194.39.94)) && !(ip.dst == 37.221.161.136)) && !(ip.dst == 178.63.141.213)) && !(ip.dst == 23.64.225.224)) && !(ip.dst == 87.240.131.118)) && !(ip.dst == 68.232.35.139)) && !(ip.dst == 173.194.39.96)) && !(ip.dst == 173.194.70.95)) && !(ip.dst == 89.184.81.35)) && !(ip.dst == 176.9.215.59)) && !(ip.dst == 193.239.68.90)) && !(ip.dst == 141.101.118.151)) && !(ip.dst == 173.194.39.136)) && !(ip.dst == 88.212.196.66)) && !(ip.dst == 173.194.39.160)) && !(ip.dst == 173.194.39.99)) && !(ip.dst == 173.194.39.64)) && !(ip.dst == 173.194.39.137)

But adding next entries with command "Apply as Filter - and not selected" poping up window with message: Syntax error The following display filter isn't a valid display filter and Filter column is red What is wrong? I need to add not limited number of entries? What should I change in files? Karmicubuntu 9.10

asked 31 May '13, 04:31

QjhgfdYyt%20Wftgy's gravatar image

QjhgfdYyt Wftgy
6●1●1●3
accept rate: 0%

edited 31 May '13, 07:59

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

One Answer:

1

The number of opening and closing braces does not match. There are more opening braces, than closing braces.

189 (
187 )

Just remove two of the opening braces and Wireshark will accept the filter. If however the filter will do what you intended is unclear, as I don't know your intention ;-).

BTW: The filter looks rather 'long'. What do you want to achieve? 'Hiding' all packets where the destination ip is one of the listed ones? If so, did you just forget the ! in front of the first statement or was that intentional?

UPDATE: According to your comment, I would use this (shorter) filter:

!(ip.dst eq x.x.x.x or ip.dst eq y.y.y.y or ip.dst eq z.z.z.z or ....)

Replace x.x.x.x, y.y.y.y etc. with your list of trusted IP addresses.

Regards
Kurt

answered 31 May '13, 07:53

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 31 May '13, 08:27

That may have been my editing to try and make it look reasonable, I thought the heap if opening braces were just some sort delimiter type effect. I'll try to put it back. :-(

(31 May '13, 07:56) grahamb ♦

Should be back to the OP's text now. Sorry.

(31 May '13, 08:00) grahamb ♦

never mind ;-) See the changes in my answer

(31 May '13, 08:03) Kurt Knochner ♦

I want to hide all ip. dst., that are trusted (to create my private database). I have putted them with command "Apply as Filter - and not selected" just that. If it is have misstake, pleese give me right position of ()!. Then I will analyse.

(31 May '13, 08:14) QjhgfdYyt Wftgy
1

just remove the first two '(' and check if the result is O.K.

BTW: see my UPDATE in the answer

(31 May '13, 08:20) Kurt Knochner ♦

It realased!!! But I can not understand. The next entrie, I have put on just, do not need pre-last brace ) 39.137) && !(ip.dst == 208.113.241.129) but should be logic needed 39.137))

(31 May '13, 08:43) QjhgfdYyt Wftgy

Enyway thanks!!!

(31 May '13, 08:44) QjhgfdYyt Wftgy

...or ...or worthy to try! Thank you!

(31 May '13, 08:52) QjhgfdYyt Wftgy
showing 5 of 8 show 3 more comments