Wireshark-users: Re: [Wireshark-users] Capture Filter for Country
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 30 Mar 2009 11:12:10 -0700

On Mar 30, 2009, at 10:47 AM, Ron Gallimore wrote:


Is it possible to create a capture filter to exclude any US IP
addresses?


Not from within Wireshark, no.  It has no code to do that.
You might be able to find address range information at ARIN's Web site; hopefully they distinguish between US and Canadian/assorted islands range allocation. Hopefully any capture filter you construct from that won't result in a BPF program too big to put into the kernel.