This is our old Q&A Site. Please post any new questions and answers at


I haven't been able to get this filter to work. Im trying to use multiple IP ranges. 4 of them.

I have been trying to use net

Ex. net

but I want to use multiple at one time

(net and net and net and net

I have tried (net and (net and (net and (net

What am I missing?

asked 21 Mar '11, 08:12

hmacken's gravatar image

accept rate: 0%

Just as Joke has said, you need to use "or" instead of "and" to collect packets from one of the given subnets. Regarding the subnet masks, what are the subnets exactly, as is indeed an invalid notation. There are only 32 bits in an IPv4 address, so having a network mask of 88 bits is not possible. If you would like to collect packets for all 4 C-class subnets, you will have to use:

net  or net  or net or net

Which of course can be shortened to

net  mask

If you only need parts of these subnets, for instance only the first 16 ip addresses of each subnet, you can use:

    net mask or net mask or net mask or net mask
permanent link

answered 21 Mar '11, 09:49

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

I suppose I was reading the wiki incorrect then. im looking for a capture string for something like this

• thru .87 • thru .90

(21 Mar '11, 10:07) hmacken

Any help here?

(21 Mar '11, 11:27) hmacken

BPF syntax does not have a range for IP addresses, just hosts and (sub)nets. You will have to break up the ip-address range into a set of subnets and hosts.

(21 Mar '11, 11:46) SYN-bit ♦♦

Use or instead of and:
net or net or net or net

permanent link

answered 21 Mar '11, 08:50

joke's gravatar image

accept rate: 9%

Invalid capture filter: "net IP or net IP or net IP or net IP" That string isnt a valid capture filter (mask length must be <=32)

Any ideas?

(21 Mar '11, 09:33) hmacken
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 21 Mar '11, 08:12

question was seen: 12,085 times

last updated: 21 Mar '11, 11:46

p​o​w​e​r​e​d by O​S​Q​A