Hi Community, I captured via a VMWare command the traffic from and to a virtual machine into a pcap file[#1]. Now I opened the pcap file in wireshark and tried to filter out the traffic belonging to the local network but no known filter works. I tried the filter expression listed on wireshark wiki but they failed with the error message for example: <"net 192.168.110.0/24" isn't a valid display filter: "192.168.1110.0./24" was unexpected in this context>. Anyone out there with a clue what's wrong with this expression? Thx & Bye Tom 1: vmnet-sniffer -e -w vmnet8.pcap vmnet8 asked 23 Jun '14, 02:55  Thomas Wildg... edited 23 Jun '14, 03:52  grahamb ♦ |
One Answer:
As per the filter page you referenced, that syntax is for capture filters. As you already have a capture you need a display filter. In your particular case the display filter would be You might also note that Wireshark 1.8.4 is quite old, 1.10.8 is the current stable release with 1.12 coming real soon now. answered 23 Jun '14, 03:02 grahamb ♦ edited 23 Jun '14, 03:03 |
Life could be so easy if you look into the right manual, thanks a lot. Because the version I thought that I installed Wireshark for a couple of month ago but you are right, there is a version 1.10 available. I will update Wireshark after this job, also thanks for that.
Bye Thomas
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.