Wireshark-users: Re: [Wireshark-users] What is wrong with this filter?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Parkis, Scott" <sparkis@xxxxxxxxxxxxxxxxxxxx>
Date: Wed, 25 Mar 2009 16:00:23 -0400

That was it. thanks

 

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Wynns, Roger [OXFORD]
Sent: Wednesday, March 25, 2009 3:50 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] What is wrong with this filter?

 

This may be what you want….

 

ip.addr==192.168.2.34 and !(ip.addr==10.1.10.150 or ip.addr==10.1.11.140)

 

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Parkis, Scott
Sent: Wednesday, March 25, 2009 1:42 PM
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] What is wrong with this filter?

 

p.addr==192.168.2.34 and (ip.addr!=10.1.10.150 and ip.addr!=10.1.11.140)

 

I want to show all packets src and/or dest from 2.34 but I do not want any packets to/from 10.150 and 11.140. I tried it with and without the () but it still shows me results with those two 10.1.x.x.

 

Thanks,