This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to exclude my traffic ?

0

First of all sorry if this is a dumb question i am somehow unexperienced...

i want to search with my network card but filter out my own traffic ... i guess the best would be to use not ip.src == xxx.xxx.xxx.xxx or not ip.addr=xxx.xxx.xxx.xxx maybe it´s possible to do this by MAC of the computer i am using ? any more graceful ideas ?(because i have more than 1 MAC i guess) and any ideas how i can prove this ? how can i see that it´s actually foreign traffic in my network ?

asked 17 Apr '14, 14:49

astrionn's gravatar image

astrionn
11113
accept rate: 0%

edited 17 Apr '14, 17:09

okay i tried to exclude my ip address via 'not ip.addr == myip' but still get my data because i dont think that my neighbor visited the same sites like me ...

(18 Apr '14, 03:38) astrionn

okay by now i excluded my ip address with ip.addr adn excluded my MAC´s but still see traffic i did ... what can i do ?

(18 Apr '14, 05:22) astrionn

okay now i guess i did all i could even imagine to do to exclude my traffic and still see my traffic ...

not ip.addr == xxx.x.xx.xxx and not ip.src == xxx.x.xx.xx and not mac ==xx-xx-xx-xx-xx-xx and not mac ==xx-xx-xx-xx-xx-xx and not ip ==xxx.x.x.x and not ip.dst == xxx.x.xx.xxx and not ip.src == xxx.x.xx.xxx

i just copy paste this filter ... and i still see my own traffic ...

(18 Apr '14, 05:36) astrionn

2 Answers:

1

This is usually done by either removing all protocol bindings from the network card (especially IP addresses), or you could filter out your own MAC address. Something like "not ether host your-MAC-address".

answered 17 Apr '14, 15:18

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

okay seems legit thx

(17 Apr '14, 15:51) astrionn

0

Substitute the "and not" on everything to "or not"

answered 20 Apr '15, 09:28

skiltvakt's gravatar image

skiltvakt
61
accept rate: 0%