This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hey there,

I have a predefined filter which looks approximately like

((http or dns or sip) and  ((ip.addr == 1.2.3.0/24) or (ip.addr == 2.3.4.0/24) or (dns contains "abcdef") or (dns contains "ddjdjdjd"))

Basically the IP ranges are SIP and config servers that are contacted. On the interface I'm tracing there will be a lot of clients that will try to do exactly what I'm filtering for and thus I only like to have the traffic which matches this rule AND my own client IP address.

I have a button that applies this filter as a predefined display filter.

I then usually add the client IP (which I read from the clients UI or I see it appearing in the list, or both) by adding "AND ip.addr == clientip".

However it would save me some minutes per day and maybe some hours per year if i could simply add the IP to the filter by performing a click on a packet from my client that appears in the trace.

I know there is "prepare filter" -> "and". But it will either (depending on what IP I selected) add "ip.dst" or "ip.src".

That will either hide away the packets coming back from the server or the ones that the client sent itself.

Is there an elegant way to solve this?

TL;DR: have a predefined filter that needs to be combined with "AND ip.addr == $selected-client-ip", how to do it easily?

asked 11 May '16, 14:09

aslmx's gravatar image

aslmx
11226
accept rate: 0%

edited 11 May '16, 14:45

Jaap's gravatar image

Jaap ♦
11.7k16101


Go into preferences, select "Protocols", check "Display hidden protocol items".

Then go back to your capture and do the same "Prepare filter" -> "...and Selected" trick, but now use it on the previously hidden field ip.host.

permanent link

answered 11 May '16, 14:48

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks. This is what i was looking for. What a pity it has been hidden so carefully...

(11 May '16, 23:07) aslmx
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×165
×46

question asked: 11 May '16, 14:09

question was seen: 735 times

last updated: 11 May '16, 23:07

p​o​w​e​r​e​d by O​S​Q​A