This is our old Q&A Site. Please post any new questions and answers at

I would like to create a display filter for an with the last 2 octets of an IP address. In this case I want to filter for the IP address . What is the display filter expression using the offset and slice operators or a wildcard expression that I would need to use?

asked 21 Jun '13, 14:06

mrproject's gravatar image

accept rate: 0%

If you are looking for a Wireshark display filter that matches either the source or the destination address, then you can use: matches "\.149\.195$"

If you only want the source address:

ip.src_host matches "\.149\.195$"

And if you only want the destination address:

ip.dst_host matches "\.149\.195$"

For more information on wireshark filters, refer to the wireshark-filter man page. Further links are provided there for more information on the "matches" operator, although one of them appears to be broken, so you can use this one instead:

permanent link

answered 21 Jun '13, 19:58

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

Try this one:

ip[14:2] eq 95c3 or ip[18:2] eq 95c3

permanent link

answered 21 Jun '13, 14:35

mrEEde2's gravatar image

accept rate: 20%

But the negative form of this does not work.

For example, if I want to filter out all traffic from 149.195../16, none of the below work. Did mrproject not post his ip address correctly? Was he trying to filter out 149.195.. or ..149.195? !matches ".149.195$"

! matches ".149.195$" !== ".149.195$"

I thought I had found the answer here:


but the above doesn't work, neither does !=

Final edit:

I got it working with !ip.addr == I didn't realize that is deprecated.

permanent link

answered 02 Jan '15, 10:12

Justin%20Goldberg's gravatar image

Justin Goldberg
accept rate: 0%

edited 02 Jan '15, 10:27


he was specifically filtering on the last two octets, so CIDR filters will not help. You need to use regex expressions.

(02 Jan '15, 13:11) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 21 Jun '13, 14:06

question was seen: 112,563 times

last updated: 02 Jan '15, 13:11

p​o​w​e​r​e​d by O​S​Q​A