This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hey,

I haven't been able to get this filter to work. Im trying to use multiple IP ranges. 4 of them.

I have been trying to use net

Ex. net 192.168.0.0/88

but I want to use multiple at one time

(net 192.168.0.0/88 and net 192.168.1.0/99 and net 192.168.2.0/77 and net 192.168.3.066)

I have tried (net 192.168.0.0/88) and (net 192.168.1.0/99) and (net 192.168.2.0/77) and (net 192.168.3.066)

What am I missing?

asked 21 Mar '11, 08:12

hmacken's gravatar image

hmacken
1111
accept rate: 0%


Just as Joke has said, you need to use "or" instead of "and" to collect packets from one of the given subnets. Regarding the subnet masks, what are the subnets exactly, as 192.168.0.0/88 is indeed an invalid notation. There are only 32 bits in an IPv4 address, so having a network mask of 88 bits is not possible. If you would like to collect packets for all 4 C-class subnets, you will have to use:

net 192.168.0.0  or net 192.168.1.0  or net 192.168.2.0 or net 192.168.3.0

Which of course can be shortened to

net 192.168.0.0  mask 255.255.252.0

If you only need parts of these subnets, for instance only the first 16 ip addresses of each subnet, you can use:

    net 192.168.0.0 mask 255.255.255.240 or net 192.168.1.0 mask 255.255.255.240 or net 192.168.2.0 mask 255.255.255.240 or net 192.168.3.0 mask 255.255.255.240
permanent link

answered 21 Mar '11, 09:49

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

I suppose I was reading the wiki incorrect then. im looking for a capture string for something like this

• 10.24.19.75 thru .87 • 10.22.20.77 thru .90

(21 Mar '11, 10:07) hmacken

Any help here?

(21 Mar '11, 11:27) hmacken
1

BPF syntax does not have a range for IP addresses, just hosts and (sub)nets. You will have to break up the ip-address range into a set of subnets and hosts.

(21 Mar '11, 11:46) SYN-bit ♦♦

Use or instead of and:
net 192.168.0.0/88 or net 192.168.1.0/99 or net 192.168.2.0/77 or net 192.168.3.066

permanent link

answered 21 Mar '11, 08:50

joke's gravatar image

joke
1.3k4934
accept rate: 9%

Invalid capture filter: "net IP or net IP or net IP or net IP" That string isnt a valid capture filter (mask length must be <=32)

Any ideas?

(21 Mar '11, 09:33) hmacken
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×41
×1
×1

question asked: 21 Mar '11, 08:12

question was seen: 11,990 times

last updated: 21 Mar '11, 11:46

p​o​w​e​r​e​d by O​S​Q​A