This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Isolating the Subnet

0

I've gone ahead and created the filter [ip.addr == 192.168.0.1/24], with the hope of only monitoring my local subnet in the Endpoints/ IPv4 window, but am still getting all the other IP addresses popping up. Any suggestions on only capturing my local network (192.168.0.1-254)?

asked 17 Dec '13, 20:21

johncalvinhall's gravatar image

johncalvinhall
11113
accept rate: 0%

converted to question 17 Dec '13, 20:30


One Answer:

3

With your filter, only one communication parter must be in your local subnet. Try this one to match only when both IP hosts are in your IP subnet:

ip.src==192.168.0.0/24 and ip.dst==192.168.0.0/24

answered 17 Dec '13, 21:51

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

That is fantastic! TYVM!

(17 Dec '13, 21:59) johncalvinhall

You're welcome - Don't forget to 'accept' the answer to mark it as closed, thanks

(17 Dec '13, 22:10) mrEEde