Ask Your Question
0

How to filter for partial IP such as 50.xxx.xxx.152

asked 2018-10-24 14:29:10 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

Hi, New to Wireshark and am looking to filter traffic to/from a partial IP address, 50.xxx.xxx.152.

What is the correct syntax? ip.host matches "\.152$" gets me the last octet but need to filter on the first as well.

Thanks, H

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
2

answered 2018-10-24 14:56:34 +0000

cmaynard gravatar image

updated 2018-10-25 21:00:32 +0000

Try this filter instead:

(ip.src[0]==32 && ip.src[3]==98) || (ip.dst[0]==32 && ip.dst[3]==98)

Those values, 32 and 98 are hexadecimal values for 50 and 152, respectively. The filter uses the slice operator [] to isolate the 1st and 4th bytes of the source and destination IP address fields. This filter also avoids any potential problems with whether name resolution is enabled or not, as ip.host isn't necessarily guaranteed to match "\.152$" if name resolution is enabled.

Note that you might be tempted to use a simpler filter such as:

ip.addr[0]==32 && ip.addr[3]==98

Unfortunately, this doesn't work reliably because it will actually match either the 1st byte of either the source or destination addresses as well as the 4th byte of either the source or destination IP addresses. For example, if the source address was 50.xxx.xxx.100 and the destination address was 100.xxx.xxx.152, then the packet would still match the filter, as the 1st byte of the source address would match as well as the last byte of the destination address.

Refer to the wireshark-filter man page for more information about the slice operator and Wireshark display filters in general.

edit flag offensive delete link more

Comments

Great, this seems to work for the display filter. Is there an equivalent for the capture filter?

Henri gravatar imageHenri ( 2018-10-24 15:16:49 +0000 )edit

For a capture filter, you'd use a very similar construct, such as:

(ip[12]=50 && ip[15]=152) || (ip[16]=50 && ip[19]=152)

Refer to Section 3.1 of RFC791 for the IPv4 header format (and offsets to the relevant source and destination IP address fields) and to the pcap-filter man page for more information on capture filters.

cmaynard gravatar imagecmaynard ( 2018-10-24 16:05:20 +0000 )edit

Great! Thank you so much!

H

Henri gravatar imageHenri ( 2018-10-24 16:37:14 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-10-24 14:29:10 +0000

Seen: 108 times

Last updated: Oct 25