This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, I need to filter a bigger number of not range-connected IP-Adresses. So I have to write them all down, but I do not find a working syntax.

I tried this:

Not Equal.ip.dst==191.168.232.139.90, 77.234.45.65, 5.45.58.148, 212.4.153.167, 52.71.81.247, 104.102.22.121

It does not work. Seperating the Adresses with "and" or "or" instead of commata does also not Work.

The Filter Line always stays red. How can I do this?

asked 27 Jun '16, 23:05

Ellevader's gravatar image

Ellevader
6112
accept rate: 0%

edited 28 Jun '16, 02:31

grahamb's gravatar image

grahamb ♦
19.8k330206


Are you looking for something like this? ! (ip.dst==191.168.232.139 or ip.dst== 77.234.45.65 or ip.dst== 5.45.58.148 or ip.dst== 212.4.153.167 or ip.dst== 52.71.81.247 or ip.dst== 104.102.22.121)

Your first IP address is wrong (5 octets) and it is not possible to have a list of addresses, this is why your search did not work. If you want to remove frames to and from those addresses you want to use ip.addr instead of ip.dst

permanent link

answered 27 Jun '16, 23:46

ae4baifee4's gravatar image

ae4baifee4
61
accept rate: 0%

THX ae4baifee4! It absolutely works.

Hi Jaap, I'm an absolute beginner on this subject and did not understand too much so far, seems I have to renew my fundamentals of knowlegde about boolean expressions in general first :(

This really helps me much at a Problem I have to solve asap.

Thanks again!

(29 Jun '16, 10:21) Ellevader

Your answer has been converted to a comment as that's how this site works. Please read the FAQ for more information.

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

Yes, Wireshark is a power tool, for power users.

(29 Jun '16, 12:32) Jaap ♦

You should read this documentation:

for more background of how Display Filters work and how to compose the expressions you want.

permanent link

answered 28 Jun '16, 01:04

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×178
×18

question asked: 27 Jun '16, 23:05

question was seen: 3,300 times

last updated: 29 Jun '16, 12:32

p​o​w​e​r​e​d by O​S​Q​A