Revision history [back]

Try this filter instead:

ip.addr[0]==32 && ip.addr[3]==98

Those values, 32 and 98 are hexadecimal values for 50 and 152, respectively. The filter uses the slice operator [] to isolate the 1st and 4th bytes of the IP address fields. This filter also avoids any potential problems with whether name resolution is enabled or not, as ip.host won't match "\.152$" if name resolution is enabled.

Refer to the wireshark-filter man page for more information about the slice operator and Wireshark display filters in general.

Try this filter instead:

ip.addr[0]==32 (ip.src[0]==32 && ip.addr[3]==98
ip.src[3]==98) || (ip.dst[0]==32 && ip.dst[3]==98)

Those values, 32 and 98 are hexadecimal values for 50 and 152, respectively. The filter uses the slice operator [] to isolate the 1st and 4th bytes of the source and destination IP address fields. This filter also avoids any potential problems with whether name resolution is enabled or not, as ip.host won't match "\.152$" if name resolution is enabled.

Note that you might be tempted to use a simpler filter such as:

ip.addr[0]==32 && ip.addr[3]==98

Unfortunately, this doesn't work reliably because it will actually match either the 1st byte of either the source or destination addresses as well as the 4th byte of either the source or destination IP addresses. For example, if the source address was 50.xxx.xxx.100 and the destination address was 100.xxx.xxx.152, then the packet would still match the filter, as the 1st byte of the source address would match as well as the last byte of the destination address.

Refer to the wireshark-filter man page for more information about the slice operator and Wireshark display filters in general.

Try this filter instead:

(ip.src[0]==32 && ip.src[3]==98) || (ip.dst[0]==32 && ip.dst[3]==98)

Those values, 32 and 98 are hexadecimal values for 50 and 152, respectively. The filter uses the slice operator [] to isolate the 1st and 4th bytes of the source and destination IP address fields. This filter also avoids any potential problems with whether name resolution is enabled or not, as ip.host won't isn't necessarily guaranteed to match "\.152$" if name resolution is enabled.

Note that you might be tempted to use a simpler filter such as:

ip.addr[0]==32 && ip.addr[3]==98

Unfortunately, this doesn't work reliably because it will actually match either the 1st byte of either the source or destination addresses as well as the 4th byte of either the source or destination IP addresses. For example, if the source address was 50.xxx.xxx.100 and the destination address was 100.xxx.xxx.152, then the packet would still match the filter, as the 1st byte of the source address would match as well as the last byte of the destination address.

Refer to the wireshark-filter man page for more information about the slice operator and Wireshark display filters in general.