Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore.

I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never really care about this traffic, so it would be nice to have it always filtered out. Is there a way to easily filter out a large number of IP addresses?

The most ideal solution would be from a file using subnet notation, like 117.173.66.0/24.

My current solution is to use a big nasty capture filter:

host 10.0.2.17 and not net 17.158.36.0/24 and not net 173.194.33.0/24 ...
share|improve this question

2 Answers 2

up vote 1 down vote accepted

I believe you want to modify the display filters: http://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html

share|improve this answer

Try this section from this page:

Filter by a protocol ( e.g. SIP ) and filter out unwanted IPs:

ip.src != xxx.xxx.xxx.xxx && ip.dst != xxx.xxx.xxx.xxx && sip

share|improve this answer
    
Thanks, but it's mostly TCP and HTTP traffic from the addresses I want to filter, and my current list has 23 addresses. I'd rather avoid using the display filter since I use it often, and don't want to have to constantly prepend a big long string of IPs to filter. –  Dean Sep 14 '12 at 2:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.