This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the display filter syntax to specify an IP subnet?

1

In the display filter, 'net' is not even in the list of expressions/filters to apply. When you type 'net' in the display filter field, it goes red and shows a list of options - none of which correspond to anything having to do with searching for an entire subnet. This feature would be nice though and if it does exist let us know the real deal.

asked 02 Aug '16, 08:16

DBP1968's gravatar image

DBP1968
21113
accept rate: 0%

converted to question 02 Aug '16, 08:36

sindy's gravatar image

sindy
6.0k4851


One Answer:

3

That's because you mix up capture filters (which the Question to which you have originally piggy-backed your one deals with) and display filters (which can be Applied).

Ιn the display filter, you can use IP subnets (or even IP ranges if you want): ip.addr == 10.5.232.0/24 has the same effect like ip.addr >= 10.5.232.0 and ip.addr <= 10.5.232.255.

answered 02 Aug '16, 08:24

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 02 Aug '16, 11:10