Wireshark-users: [Wireshark-users] question re: problem similar to display filter for multiple IP
From: Karen Isaacson <kareni@xxxxxxxxxxxxxx>
Date: Thu, 10 May 2007 14:41:32 -0700
I'm in a classroom situation learning to use Wireshark and other forensic tools and I can filter IP addresses with ease but due to the configuration of the classroom [instructor's insistence] all workstations are on the same subnet. If I filter for x.x.x.12, I also get x.x.x.121, .123, etc.

WIKI and FAQs don't show how to specify one IP only from a block of similar addresses and the mechanism for filtering as described in the multiple IPs thread won't work unless I specify all the other addresses. I told the instructor that filtering on the MAC address was more predictable in this case but he's not convinced that there isn't some way to filter IPs.

What do I need to add to restrict the IP value to exactly what I want and not variants on that value? Is there a wildcard I can use?

Thanks in advance for any help.

Karen Isaacson