Wireshark-users: Re: [Wireshark-users] question re: problem similar to display filterfor multiple
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Greg Helps" <greg@xxxxxxxxxxxx>
Date: Fri, 11 May 2007 07:28:41 +0930
> Karen Isaacson wrote:
> 
> I'm in a classroom situation learning to use Wireshark and 
> other forensic tools and I can filter IP addresses with ease 
> but due to the configuration of the classroom [instructor's 
> insistence] all workstations are on the same subnet.  If I 
> filter for x.x.x.12, I also get x.x.x.121, .123, etc.
> 

> 
> What do I need to add to restrict the IP value to exactly 
> what I want and not variants on that value?  Is there a 
> wildcard I can use?
> 

What syntax have you tried? As a capture filter it should be:
host x.x.x.12

Or a display filter:
ip.addr == x.x.x.12

Cheers
Greg