Hi, What is the syntax in the latest Wireshark version to select 2 ip addresses for a capture filter? Thanks. Eric asked 18 Oct '17, 08:53  ekatow showing 5 of 8 show 3 more comments |
One Answer:
If you want "packets from 192.9.200.1 to 192.9.200.2 and packets from 192.9.200.2 to 192.9.200.1.", then the capture filter would be You can also use host names, but you'd have to use This will not, however, limit itself to, for example, requests from 192.9.200.1 and responses to those requests from 192.9.200.2; it will include all packets, whether the ones from 192.9.200.1 happen to be requests or not and whether the ones from 192.9.200.2 happen to be responses or not. All that filter looks at are IP addresses in the IPv4 header (or, for answered 18 Oct '17, 09:47  Guy Harris ♦♦ If you want traffic in both directions, you could shorten this to "host 192.9.200.1 and host 192.9.200.2". (19 Oct '17, 16:27) Jim Aragon |
The syntax is the same as it's always been as it's BPF syntax as shown here.
Do you only want packets between the 2 IP addresses or packets to or from either address?
Traffic to and from either address
For example, you want to see all traffic to or from 192.9.200.1 and all traffic to or from 192.9.200.2, regardless of what host traffic to 192.9.200.{1,2} is coming from and what host traffic from 192.9.200.{1,2} is going to?
Ideally, I want to see what is coming from 192.9.200.1 (requests) and what is coming from 192.9.200.2 (responses).
I.e., you want to see all traffic from 192.9.200.1 and all traffic from 192.9.200.2?
What about traffic to those hosts?
Or do you only want the traffic between 192.9.200.1 and 192.9.200.2, i.e. packets from 192.9.200.1 to 192.9.200.2 and packets from 192.9.200.2 to 192.9.200.1, and no packets from or to one of those hosts to or from any third host?
only want the traffic between 192.9.200.1 and 192.9.200.2, i.e. packets from 192.9.200.1 to 192.9.200.2 and packets from 192.9.200.2 to 192.9.200.1.
Still unclear to me,the filter doesn't know about requests and responses only source and destination. Given hosts of interest, a & b there can be the following types of traffic:
Which of these do you want?
1 and 2: From a to b. and what b had to say about what a sent.