Wireshark Filter: Source and Destination IP

When analyzing network protocol traffic using Wireshark, it is often necessary to filter the packets displayed in order to focus on specific information. One common type of filter used is the source and destination IP filter, which allows you to restrict the packet view to only those packets that have a specified source or destination IP address.

To apply a source IP filter in Wireshark, use the following syntax: `ip.src = 'IP Address'`. For example, if you want to see only packets with a source IP of 192.168.1.1, you would enter `ip.src = 192.168.1.1`.

To apply this filter, follow these steps:

1. Open Wireshark and select the network interface on which you want to capture traffic.

2. Click on 'Capture' > 'Interfaces' from the menu to display a list of available interfaces.

3. Select the desired interface and start the capture.

Once you have opened Wireshark, you will see a screen displaying all the packets captured from your selected network interface. To apply the source IP filter, follow these steps:

1. Click on 'Filter' > 'Display Filter' from the menu.

2. In the display filter dialog box, enter `ip.src = 192.168.1.1` and click 'Apply'.

Wireshark will then only display packets with a source IP of 192.168.1.1. This can be useful when trying to troubleshoot network issues or analyze specific types of traffic.

In addition to the source IP filter, Wireshark also allows you to apply a destination IP filter using the syntax `ip.dst = 'IP Address'`. By combining these two filters, you can further refine your packet view to only include packets that meet specific criteria.

Overall, Wireshark's display filter capabilities make it an essential tool for network troubleshooting and analysis. Whether you need to analyze protocol traffic going out or coming into your machine, Wireshark is one of the best tools available for the job.

Wireshark filter source and destination ip