 | 1 | initial version |
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in either the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.
| | 2 | No.2 Revision |
If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in either EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.
If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
| | 3 | No.3 Revision |
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.srcEITHER or the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.
If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH BOTH the ip.src and ip.dst ip.src and ip.dst fields, then the following display filter will accomplish that request.
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
| | 4 | No.4 Revision |
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.
If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
| | 5 | No.5 Revision |
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.
If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
| | 6 | No.6 Revision |
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})
If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.
If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.
!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})