This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Basically what I want is to stop displaying packets from a host if I have earlier received a packet from it. This will not only decrease the size of output but also make analyzing packets much more convenient. Is there a way to do this ?

asked 19 Jun '15, 05:17

Backspace's gravatar image

Backspace
31347
accept rate: 0%

Basically what I want is to stop displaying packets from a host if I have earlier received a packet from it.

So I assume you need a display filter which excludes the host from displaying. Have you tried a filter like this:

!(ip.addr==10.0.0.1)

(19 Jun '15, 15:00) Christian_R

Both capture filters and display filters are stateless, so they can't remember that a packet has been seen from a given host and either discard or filter out subsequent packets from the host. There's no other mechanism I know of in Wireshark to do what you want.

permanent link

answered 19 Jun '15, 17:34

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×61

question asked: 19 Jun '15, 05:17

question was seen: 1,040 times

last updated: 19 Jun '15, 17:34

p​o​w​e​r​e​d by O​S​Q​A