 | 1 | initial version |
Wireshark doesn't have an address wildcard display filter. If there was an addr display filter, it would be true for every frame because routing requires an address. The user can use the.addr extension to filter for specific protocol address information. As to your example with the field names that might be included: ip.addr, ipv6.addr, eth.addr, and etc. Almost everything would be covered with the "ip or ipv6 or eth" filter. The statement "almost everything" is because I haven't worked on a packet capture that this wasn't true.
If you haven't already, check out the Wireshark-filter and Wireshark display filter reference webpages. The Wireshark-filter shows how to create Wireshark filters and the Wireshark display reference shows information about all the different Wireshark fields and protocols.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
