0

Newbee question: Unable to use wireshark filter syntax.

filter
uses

asked 2019-07-25 10:52:01 +0000

Johi
1 ●1 ●1

Hello, The Wireshark-filter. HTML clearly explains: ip.dst == 192.168.1.1 is a valid filter. However, if I put this filter in the "wireshark capture interfaces" dialog box in the line "Capture filter for selected interfaces", the background stays red. If I use the basic "UDP" statement in this filter dialog box, it works.

Any idea why the filter syntax does not seem to work in the dialog box? (The NIC is connected to a network where the router is 192.168.1.1 so i do not expect a problem from this side) Thanks in advance, Johi.

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted

0

answered 2019-07-25 16:27:30 +0000

millerlw
1 ●1

That is a display filter. If you want a capture filter, use one of these host 192.168.1.1 dst host 192.168.1.1

edit flag offensive delete link

0

answered 2019-07-25 11:09:12 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

updated 2019-07-25 14:02:44 +0000

flag of United States of America

11115 ●11 ●317 ●165 https://www.igt.com/

Wireshark has two filter syntaxes, for capture filters, also known as BPF filter and display filters.

More information can be found in the User Guide, 4.13. Filtering while capturing and 6.3. Filtering Packets While Viewing.

edit flag offensive delete link

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Question Tools

1 follower

Stats

Asked: 2019-07-25 10:52:01 +0000

Seen: 769 times

Last updated: Jul 25 '19

Related questions