 | 1 | initial version |
The "least typing" syntax of your first filter would be as follows:
ip.src in {192.168.0.0/16 172.16.0.0/12 10.0.0.0/8} && ip.dst in {192.168.0.0/16 172.16.0.0/12 10.0.0.0/8}
I'm afraid there is no way to avoid using the list of match values twice if you want to compare two distinct variables to that list.
Whether you use capture filter or display filter depends more on whether you need to reduce the amount of data to be saved (which is the application case for a capture filter) or to be sure that you do not miss anything (which is the application case for not using any capture filter and using display filter to post-analyse the data).
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
