As an IP datagram contains both a source and a destination address, the expression will evaluate to true whenever at least one of the two addresses differs from 1.2.3.4. The reason for this, is that the expression ip.addr != 1.2.3.4 must be read as “the packet contains a field named ip.addr with a value different from 1.2.3.4”. Instead, that expression will even be true for packets where either source or destination IP address equals 1.2.3.4. Unfortunately, this does not do the expected. Then they use ip.addr != 1.2.3.4 to see all packets not containing the IP address 1.2.3.4 in it. Often people use a filter string to display something like ip.addr = 1.2.3.4 which will display all packets containing the IP address 1.2.3.4. Using the != operator on combined expressions like eth.addr, ip.addr, tcp.port, and udp.port will probably not work as expected.

Which filters packets where either the source OR the destination is not C, and that's every packet, so it shows every packet. Which filters packets where source or destination match, and then hides them (correctly).

Quit without Saving to discard the captured traffic.In Boolean Logic, A not equals B and not A equals B are the same test.īut, the relevant part of the WireShark documentation linked by Jürgen Thelen explains that in WireShark, ip.addr covers both the source and destination field, so the test is more like: not ((A or B) equals C)

Close Wireshark to complete this activity.

Click Clear on the Filter toolbar to clear the display filter.

Observe that the Packet List Pane is now filtered so that only traffic to (destination) or from (source) IP address 8.8.8.8 is displayed.

Type ip.addr = 8.8.8.8 in the Filter box and press Enter.

Use ping 8.8.8.8 to ping an Internet host by IP address.Īctivity 2 - Use a Display Filter.

YouTube: Wireshark 101: Display Filters and Filter Options, HakTip 122Īctivity 1 - Capture Network Traffic.

The problem with display filter is that, log file gets REALLY REALLY HUGE after just a little amount of capture. These activities will show you how to use Wireshark to capture and filter network traffic using a display filter. Using the HTTP filters, you can do this: http.host ''. Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis.

Download wireshark filter by ip