How to Define an IP Range With Wireshark

In this video, Tony Fortunato demonstrates how to configure a Wireshark capture filter that allows you to filter by source and destination IP.

Tony Fortunato

March 8, 2017

1 Min Read
How to Define an IP Range With Wireshark
Borka Kiss / Alamy Stock Photo

One of the keys to being an effective network troubleshooter when using a protocol analyzer is the ability to see patterns, which is where filters come into play. In this video, I review the two most common filters in Wireshark. Note that in Wireshark, display and capture filter syntax are completely different. A capture filter is configured prior to starting your capture and affects what packets are captured. A display filter is configured after you have captured your packets.

You may not know what to focus on when you capture packets, resulting in no capture filter. Even when you have a capture filter, it may be too generic. In either case, you will need to use a display filter to narrow the traffic down.

In this video, I respond to a question from one of my readers who wanted to create a Wireshark display filter for many IP addresses. One time-consuming approach would be to literally type out all the addresses you want to filter by. However, if the addresses are contiguous or in the same subnet, you might be able to get away with a Wireshark subnet filter.

The display filter syntax to filter out addresses between 192.168.1.1 – 192.168.1.255 would be ip.addr==192.168.1.0/24 and if you are comfortable with IP subnetting, you can alter the /24 to change the range.

About the Author

Tony Fortunato

Sr Network Performance Specialist

Tony Fortunato is a network performance expert who has been designing, implementing and troubleshooting networks since 1989. His company, The Technology Firm, provides clients of all sizes with services ranging from project management, network design, consulting, troubleshooting, designing custom-designed training courses, and assisting with equipment installation. Tony's experience in networking started with financial trading floor networks and ISPs, where he learned to integrate and support equipment from various vendors. Tony has taught and presented at numerous colleges and universities, public forums and private classes. He blogs frequently at NetworkDataPediaand has a popular YouTube channel.

SUBSCRIBE TO OUR NEWSLETTER
Stay informed! Sign up to get expert advice and insight delivered direct to your inbox

You May Also Like


More Insights