[Wireshark-users] Display Filter for multiple IP's?
Hello, This may have been asked before, so apologies if it is a repeat. If I want to filter OUT 1 IP from a Wireshark Capture, I can use the expression: ! ( ip.addr == 10.0.0.1) However, I would like to filter out multiple IP's from the capture file. I thought doing it like so would work: ! ( ip.addr == 10.0.0.1) or ! ( ip.addr == 10.0.0.2) But this did not work the way I expected it to. So, does anyone know how to filter out multiple IP's from a capture file at one time? Thanks for the help! ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
Re: [Wireshark-users] Display Filter for multiple IP's?
! (ip.addr == 10.1.1.1 or ip.addr == 10.2.2.2 or ip.addr == 10.3.3.3 ) On 3/5/07, Richard Biever [EMAIL PROTECTED] wrote: Hello, This may have been asked before, so apologies if it is a repeat. If I want to filter OUT 1 IP from a Wireshark Capture, I can use the expression: ! ( ip.addr == 10.0.0.1) However, I would like to filter out multiple IP's from the capture file. I thought doing it like so would work: ! ( ip.addr == 10.0.0.1) or ! ( ip.addr == 10.0.0.2) But this did not work the way I expected it to. So, does anyone know how to filter out multiple IP's from a capture file at one time? Thanks for the help! ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users -- This information is top security. When you have read it, destroy yourself. -- Marshall McLuhan ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
Re: [Wireshark-users] Display Filter for multiple IP's?
Thank you! Worked like a champ! Luis Ontanon wrote: ! (ip.addr == 10.1.1.1 or ip.addr == 10.2.2.2 or ip.addr == 10.3.3.3 ) On 3/5/07, Richard Biever [EMAIL PROTECTED] wrote: Hello, This may have been asked before, so apologies if it is a repeat. If I want to filter OUT 1 IP from a Wireshark Capture, I can use the expression: ! ( ip.addr == 10.0.0.1) However, I would like to filter out multiple IP's from the capture file. I thought doing it like so would work: ! ( ip.addr == 10.0.0.1) or ! ( ip.addr == 10.0.0.2) But this did not work the way I expected it to. So, does anyone know how to filter out multiple IP's from a capture file at one time? Thanks for the help! ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
Re: [Wireshark-users] Display Filter for multiple IP's?
On 3/5/07, Richard Biever [EMAIL PROTECTED] wrote: Thank you! Worked like a champ! It was a *logical* think for it to work. :-) Luis Ontanon wrote: ! (ip.addr == 10.1.1.1 or ip.addr == 10.2.2.2 or ip.addr == 10.3.3.3 ) On 3/5/07, Richard Biever [EMAIL PROTECTED] wrote: Hello, This may have been asked before, so apologies if it is a repeat. If I want to filter OUT 1 IP from a Wireshark Capture, I can use the expression: ! ( ip.addr == 10.0.0.1) However, I would like to filter out multiple IP's from the capture file. I thought doing it like so would work: ! ( ip.addr == 10.0.0.1) or ! ( ip.addr == 10.0.0.2) But this did not work the way I expected it to. So, does anyone know how to filter out multiple IP's from a capture file at one time? Thanks for the help! ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users -- This information is top security. When you have read it, destroy yourself. -- Marshall McLuhan ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
Re: [Wireshark-users] Display Filter for multiple IP's?
Luis Ontanon wrote: ! (ip.addr == 10.1.1.1 or ip.addr == 10.2.2.2 or ip.addr == 10.3.3.3 ) Which any worker in symbolic logic will tell you is the same as: !(ip.addr == 10.1.1.1) and !(ip.addr == 10.2.2.2) and !(ip.addr == 10.3.3.3 ) So the OP could have just swapped or for and. -- There's no point in being grown up if you can't be childish sometimes. -- Dr. Who ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
