Hi, I need to filter a bigger number of not range-connected IP-Adresses. So I have to write them all down, but I do not find a working syntax. I tried this: Not Equal.ip.dst==191.168.232.139.90, 77.234.45.65, 5.45.58.148, 212.4.153.167, 52.71.81.247, 104.102.22.121 It does not work. Seperating the Adresses with "and" or "or" instead of commata does also not Work. The Filter Line always stays red. How can I do this? asked 27 Jun '16, 23:05  Ellevader edited 28 Jun '16, 02:31  grahamb ♦ |
2 Answers:
Are you looking for something like this? ! (ip.dst==191.168.232.139 or ip.dst== 77.234.45.65 or ip.dst== 5.45.58.148 or ip.dst== 212.4.153.167 or ip.dst== 52.71.81.247 or ip.dst== 104.102.22.121) Your first IP address is wrong (5 octets) and it is not possible to have a list of addresses, this is why your search did not work. If you want to remove frames to and from those addresses you want to use ip.addr instead of ip.dst answered 27 Jun '16, 23:46  ae4baifee4 |
You should read this documentation: for more background of how Display Filters work and how to compose the expressions you want. answered 28 Jun '16, 01:04  Jaap ♦ |
THX ae4baifee4! It absolutely works.
Hi Jaap, I'm an absolute beginner on this subject and did not understand too much so far, seems I have to renew my fundamentals of knowlegde about boolean expressions in general first :(
This really helps me much at a Problem I have to solve asap.
Thanks again!
Your answer has been converted to a comment as that's how this site works. Please read the FAQ for more information.
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.
Yes, Wireshark is a power tool, for power users.