Ask Your Question

Using matches "^10\." doesn't recognize \. as a period [closed]

asked 2021-07-27 17:28:22 +0000

I'm trying to filter Ip addresses by certain parts. For example, I want to get all Ip addresses where the first octet is 10. The problem is that when I try matches "^10." its also brings up all addresses that start with 100-109. For example, if I was searching using matches "^10." and would bring up, but it might also bring up The desired result would be for it to only bring up addresses that have 10 in the first octet.

How do I get the desired result?

edit retag flag offensive reopen merge delete

Closed for the following reason the question is answered, right answer was accepted by valerie.lidiak
close date 2021-07-27 17:48:30.012999

1 Answer

Sort by ยป oldest newest most voted

answered 2021-07-27 17:36:02 +0000

Chuckc gravatar image

updated 2021-07-27 17:38:10 +0000

There are examples of this in the Wireshark User's Guide: matches "acme\\.(org|com|net)"
The display filter above matches HTTP packets where the HOST header contains,, or Comparisons are case-insensitive.

WSUG: 6.4.2. Comparing Values
"Another common pitfall is using . instead of \. in a regular expression. The former will match any character (the backslash is superfluous) while the latter will match a literal dot."

Try: matches "^10\\."

(xkcd 1638: Backslashes)

edit flag offensive delete link more


Thank you! I completely missed that

valerie.lidiak gravatar imagevalerie.lidiak ( 2021-07-27 17:47:46 +0000 )edit

Question Tools


Asked: 2021-07-27 17:28:22 +0000

Seen: 413 times

Last updated: Jul 27 '21