Extending on your work this comes to the following expression:
ip.src in {192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16, 0.0.0.0} and ip.dst in {192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 224.0.0.0/4, 169.254.0.0/16, 255.255.255.255}
- Both source _and_ destination addresses need to be in specific ranges. Otherwise local generated traffic for external addressed would show up.
- The source could also be an Automatic IPv4 address (169.254.0.0/8)
- The source could also be an unconfigured IPv4 address (0.0.0.0)
- The destination could also be a multicast address (224.0.0.0/4)
- The destination could also be an Automatic IPv4 address (169.254.0.0/8)
- The destination could also be the broadcast address (255.255.255.255)
btw: items in a list should be separated by ,
