many to many comparision [display private networks as example]

DisplayFilters

asked 2018-04-13 16:59:09 +0000

updated 2018-04-13 17:13:27 +0000

I'm looking for the best way to do a many to many comparison in wireshark. In this case I want to limit the display filter to only show internal only traffic.

This way doesn't work
(ip.src && ip.dst) == (192.168.0.0/16 || 172.16.0.0/12 || 10.0.0.0/8)

And while this other way works, it will become very difficult to read and manage once you start adding your individual exclusions from vpns and add in your dmz(s)
(ip.src == 192.168.0.0/16 || ip.src == 172.16.0.0/12 || ip.src == 10.0.0.0/8) && (ip.dst == 192.168.0.0/16 || ip.dst == 172.16.0.0/12 || ip.dst == 10.0.0.0/8)

Also I know this specific case should probably a capture filter instead, I'm just using this as an example to explore this question for display filters since they're more widely used for a lot of things.

And a side question, how do I save a display filter expression for common use?

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2018-04-14 16:10:19 +0000

mrEEde
4033 ●16 ●48 ●77

I guess the filter you are looking for could be

ip.src in {192.168.0.0/16  172.16.0.0/12  10.0.0.0/8} and ip.dst in {192.168.0.0/16  172.16.0.0/12  10.0.0.0/8}

But there are many other ways to achieve this ...
Saving a filter for later use can be done in the
(1) Add Display Filter Button
or under
(2) Manage saved Bookmarks -> Save filter image description

edit flag offensive delete link

add a comment

answered 2018-04-14 17:01:03 +0000

sindy
6209 ●5 ●66 ●55

The "least typing" syntax of your first filter would be as follows:

ip.src in {192.168.0.0/16 172.16.0.0/12 10.0.0.0/8} && ip.dst in {192.168.0.0/16 172.16.0.0/12 10.0.0.0/8}

I'm afraid there is no way to avoid using the list of match values twice if you want to compare two distinct variables to that list.

Whether you use capture filter or display filter depends more on whether you need to reduce the amount of data to be saved (which is the application case for a capture filter) or to be sure that you do not miss anything (which is the application case for not using any capture filter and using display filter to post-analyse the data).

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

many to many comparision [display private networks as example]

2 Answers

Your Answer

Question Tools

Stats

Related questions

many to many comparision [display private networks as example] edit

2 Answers

Your Answer

Question Tools

Stats

Related questions

many to many comparision [display private networks as example]