This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Filters not working 1.8.4 on Apple Mac OS 10.7.5

0

Hi Community, I captured via a VMWare command the traffic from and to a virtual machine into a pcap file[#1]. Now I opened the pcap file in wireshark and tried to filter out the traffic belonging to the local network but no known filter works. I tried the filter expression listed on wireshark wiki but they failed with the error message for example: <"net 192.168.110.0/24" isn't a valid display filter: "192.168.1110.0./24" was unexpected in this context>. Anyone out there with a clue what's wrong with this expression?

Thx & Bye Tom

1: vmnet-sniffer -e -w vmnet8.pcap vmnet8

asked 23 Jun '14, 02:55

Thomas%20Wildgruber's gravatar image

Thomas Wildg...
11112
accept rate: 0%

edited 23 Jun '14, 03:52

grahamb's gravatar image

grahamb ♦
19.8k330206


One Answer:

0

As per the filter page you referenced, that syntax is for capture filters. As you already have a capture you need a display filter.

In your particular case the display filter would be ip.src==192.168.110.0/24 and ip.dst==192.168.110.0/24.

You might also note that Wireshark 1.8.4 is quite old, 1.10.8 is the current stable release with 1.12 coming real soon now.

answered 23 Jun '14, 03:02

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 23 Jun '14, 03:03

Life could be so easy if you look into the right manual, thanks a lot. Because the version I thought that I installed Wireshark for a couple of month ago but you are right, there is a version 1.10 available. I will update Wireshark after this job, also thanks for that.

Bye Thomas

(23 Jun '14, 03:22) Thomas Wildg...

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(23 Jun '14, 03:53) grahamb ♦