This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to prevent an IP from displaying in a live capture?

0

Hi, everytime I hit "start a new live capture" a set of new Ips will pop up. Whenever I press ignore on the IPS I do not want to show up ever again, they still show up whenever I do another live capture... How do I prevent this from happening?

Say I want 192.168.1.215 and 239.255.255.250 to not show up again, what do I do?

Also, is it possible to copy Ip addresses found in live captures to your clipboard? So you dont have to type them out?

Thank you

asked 20 Jan '16, 15:03

julian4445's gravatar image

julian4445
0113
accept rate: 0%


One Answer:

0

You can apply a display filter like !(ip.addr == ip.add.re.ss1) and !(ip.addr == ip.add.re.ss2) during live capture.

You can build the display filter expression step-by-step by right-clicking on a line representing a packet field (like source IP address) in the packet dissection pane and choose Apply as Filter -> ... and not Selected from the context menu. To do so conveniently when a capture is running, it is better to switch off the automatic scrolling of the packet list before doing it.

You cannot build display filter expressions which use pseudo-fields (such as ip.addr which represents ip.src and ip.dst simultaneously) this way (i.e. Apply as Filter ->) because they are not available as lines in the packet dissection, but you may use e.g. ip.dst to get the address to the filter expression and then manually change ip.dst to ip.addr.

You can save named (labelled) pre-defined display filters for single-click application in future: at the rightmost end of the line which contains the display filter form field, there is a "+" button. When you press it, another form line is inserted between the original one and the packet list pane, where the filter expression is pre-filled with a copy of the currently used one, and it is enough to fill in the "label" form field and press OK. The additional line disappears and a button with the label you've just filled in is added to the right from the "+" button. Pressing one of these "label" buttons applies the corresponding filter. There is also another button, Filter Expression Preferences, on that additional line, which is a shortcut to the preferences dialog, where you can enable/disable, add and delete your single-click display filters. Only the enabled ones are available as buttons next to the "+".

answered 20 Jan '16, 16:08

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 20 Jan '16, 16:10

You're of great help, thank you! Whenever I click apply as filter and then "not selected" and I try to do it to another source IP Address, it gets rid of the current filter. How do I prevent that from happening?

(21 Jan '16, 20:55) julian4445

Click on "Apply as Filter" and then "...and not Selected."

"Selected" or "Not Selected" will replace the current display filter. Any of the choices beginning with "..." will add to the current display filter.

(21 Jan '16, 22:53) Jim Aragon