how do i capture packets from only 1 IP address
I'm new here and am only interested in capturing packets from 1 IP address? Is this possible and if so how can I do this? thanks in advance!
I'm new here and am only interested in capturing packets from 1 IP address? Is this possible and if so how can I do this? thanks in advance!
Yes, it's possible - that's what "capture filters" are for; see the Wireshark User's Guide (look for "capture filters" in several places).
The syntax for capture filters is defined in the pcap-filter man page.
The filters to test for a single IP address are simple:
src host 192.16.135.134
or just src 192.16.135.134
.dst host 192.16.135.134
or just dst 192.16.135.134
.host 192.16.135.134
.(Remember, if you want to capture all traffic involving that one IP address, capturing packets from that address won't work - that won't show traffic to that address.)
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2020-01-29 01:18:15 +0000
Seen: 60,887 times
Last updated: Jan 29 '20