Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore.

I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never really care about this traffic, so it would be nice to have it always filtered out. Is there a way to easily filter out a large number of IP addresses?

The most ideal solution would be from a file using subnet notation, like

My current solution is to use a big nasty capture filter:

host and not net and not net ...
share|improve this question
up vote 1 down vote accepted

I believe you want to modify the display filters:

share|improve this answer

Try this section from this page:

Filter by a protocol ( e.g. SIP ) and filter out unwanted IPs:

ip.src != && ip.dst != && sip

share|improve this answer
Thanks, but it's mostly TCP and HTTP traffic from the addresses I want to filter, and my current list has 23 addresses. I'd rather avoid using the display filter since I use it often, and don't want to have to constantly prepend a big long string of IPs to filter. – Dean Sep 14 '12 at 2:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.