This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Now that we can capture on two or more interfaces concurrently with 1.7, is there a way to create a dislay filter only on one or the other within the capture file? Or in the case of, say 4 ethernet interfaces, filter on the first 2 and not the last 2. Application (in my case), you have the main corp network and a separate segment for a test lab and yet another for the accounting dept. I can think of some roundabout ways of doing it but I was looking for something like "!ip.int == eth0/1 && !ip.int == eth0/3". Wishful thinking maybe but I can definitely see this coming up in the near future.

asked 07 Aug '11, 21:35

EricKnaus's gravatar image

EricKnaus
46192026
accept rate: 0%

edited 08 Aug '11, 21:56

helloworld's gravatar image

helloworld
3.1k42041

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×165
×47

question asked: 07 Aug '11, 21:35

question was seen: 3,845 times

last updated: 08 Aug '11, 21:56

p​o​w​e​r​e​d by O​S​Q​A