This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Community, I captured via a VMWare command the traffic from and to a virtual machine into a pcap file[#1]. Now I opened the pcap file in wireshark and tried to filter out the traffic belonging to the local network but no known filter works. I tried the filter expression listed on wireshark wiki but they failed with the error message for example: <"net 192.168.110.0/24" isn't a valid display filter: "192.168.1110.0./24" was unexpected in this context>. Anyone out there with a clue what's wrong with this expression?

Thx & Bye Tom

1: vmnet-sniffer -e -w vmnet8.pcap vmnet8

asked 23 Jun '14, 02:55

Thomas%20Wildgruber's gravatar image

Thomas Wildg...
11112
accept rate: 0%

edited 23 Jun '14, 03:52

grahamb's gravatar image

grahamb ♦
19.8k330206


As per the filter page you referenced, that syntax is for capture filters. As you already have a capture you need a display filter.

In your particular case the display filter would be ip.src==192.168.110.0/24 and ip.dst==192.168.110.0/24.

You might also note that Wireshark 1.8.4 is quite old, 1.10.8 is the current stable release with 1.12 coming real soon now.

permanent link

answered 23 Jun '14, 03:02

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 23 Jun '14, 03:03

Life could be so easy if you look into the right manual, thanks a lot. Because the version I thought that I installed Wireshark for a couple of month ago but you are right, there is a version 1.10 available. I will update Wireshark after this job, also thanks for that.

Bye Thomas

(23 Jun '14, 03:22) Thomas Wildg...

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(23 Jun '14, 03:53) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×184
×165

question asked: 23 Jun '14, 02:55

question was seen: 1,496 times

last updated: 23 Jun '14, 03:53

p​o​w​e​r​e​d by O​S​Q​A