Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore.

I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never really care about this traffic, so it would be nice to have it always filtered out. Is there a way to easily filter out a large number of IP addresses?

The most ideal solution would be from a file using subnet notation, like 117.173.66.0/24.

My current solution is to use a big nasty capture filter:

host 10.0.2.17 and not net 17.158.36.0/24 and not net 173.194.33.0/24 ...
share|improve this question
up vote 1 down vote accepted

I believe you want to modify the display filters: http://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html

share|improve this answer

Try this section from this page:

Filter by a protocol ( e.g. SIP ) and filter out unwanted IPs:

ip.src != xxx.xxx.xxx.xxx && ip.dst != xxx.xxx.xxx.xxx && sip

share|improve this answer
    
Thanks, but it's mostly TCP and HTTP traffic from the addresses I want to filter, and my current list has 23 addresses. I'd rather avoid using the display filter since I use it often, and don't want to have to constantly prepend a big long string of IPs to filter. – Dean Sep 14 '12 at 2:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .