how to ignore traffic from more then one host.

Question

I am trying to capture data but am getting a flood of data from a replicating server that i need to filter out. Basically i would like to filter out any traffic between 192.168.1.1 and 192.168.1.2 as well as ignore traffic that has a source address of 192.168.1.3 to either 192.168.1.1 and 192.168.1.2.

I have tried these captures and the only one that seems to work the way i need it is the first one:

tshark not host 192.168.1.1 and not host 192.168.1.2

When I have tried to filter out the src ip to the dst ip I noticed i was filtering all traffic:

tshark not src 192.168.1.3 and not dst 192.168.1.1

Also, how would I join the filters into one line?

tshark not host 192.168.1.1 and not host 192.168.1.2 and not src 192.168.1.3 and not dst 192.168.1.1

Any help would be appreciated.

Accepted Answer

From your post:

any traffic between 192.168.1.1 and 192.168.1.2

This would create a filter like:

host 192.168.1.1 and host 192.168.1.2

And:

a source address of 192.168.1.3 to either 192.168.1.1 and 192.168.1.2.

This would create a filter like:

src host 192.168.1.3 and (dst host 192.168.1.1 or 192.168.1.2)

Combined it makes:

(host 192.168.1.1 and host 192.168.1.2) or (src host 192.168.1.3 and (dst host 192.168.1.1 or 192.168.1.2))

And then you don't want to see this traffic, so it becomes:

not ( (host 192.168.1.1 and host 192.168.1.2) or (src host 192.168.1.3 and (dst host 192.168.1.1 or 192.168.1.2)) )