This is our old Q&A Site. Please post any new questions and answers at

Hi all, need some help with Wireshark,

I created the below filter,

(ip.src== || (ip.src== || (ip.dst== || (ip.dst== || (ip.dst== || (ip.src== || (eth.addr ==D0:87:E2:23:E0:0E)

However it shows everything containing these IP's, I want wireshark to only display output if all of the above conditions are met, so if the mac address condition is not met or another condition is not met I don't want to see it in the output. I only want it to be shown in the output if all the above conditions are met, does anyone know how to do this? Thanks

asked 19 Oct '15, 07:52

sheraz35's gravatar image

accept rate: 0%

Change the logical or's (||) to logical and's (&&).

permanent link

answered 19 Oct '15, 07:56

Jim%20Aragon's gravatar image

Jim Aragon
accept rate: 24%

That will not work. The expression has multiple ip.src and ip.dst filters. If all OR's are replaced by AND's, then nothing will be displayed. For example,

(ip.src== && (ip.src== ==> how can a packet have 2 IP sources (assuming no tunneling)?

@sheraz35 = you will need to do a combination of AND's and OR's to get you need.

(19 Oct '15, 08:33) Amato_C

Amato_C, you are, of course, right. I read (hastily) "I want Wireshark to only display output if all of the above conditions are met." mrEEDE's response is probably what is wanted.

(19 Oct '15, 11:46) Jim Aragon

This may be what you want to achieve ...

eth.addr ==D0:87:E2:23:E0:0E && (ip.addr== || ip.addr== || ip.addr==
permanent link

answered 19 Oct '15, 10:08

mrEEde's gravatar image

accept rate: 20%

While thinking about your description, I can see two 'plausible' filters.

Filter #1: communication between the IP addresses (src and dst) addresses and/or the MAC address

eth.addr ==D0:87:E2:23:E0:0E or ((ip.addr == or ip.addr == or ip.addr == ) and (ip.addr == or ip.addr == or ip.addr ==

But that filter does not make much sense to me , so I came up with the second filter.

Filter #2: communication between the addresses 10.70.40.x <-> through a certain gateway D0:87:E2:23:E0:0E

eth.addr == D0:87:E2:23:E0:0E and (ip.addr == and (ip.addr == or ip.addr ==


permanent link

answered 19 Oct '15, 16:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 19 Oct '15, 16:53

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Oct '15, 07:52

question was seen: 4,038 times

last updated: 19 Oct '15, 16:53

p​o​w​e​r​e​d by O​S​Q​A