0

I want to filter IPs on a .cap file , I use the command ip.addr == 123.456.789 but this only filters out one IP , I was wondering if there was a way to filter out multiple IPs ? thanks

helloworld0722
  • 11
  • 1
  • 1
  • 3

1 Answers1

1

try this: 

tshark -i em0 host 10.25.100.2 or host 10.25.100.3
animuson
  • 53,861
  • 28
  • 137
  • 147
Boris Ivanov
  • 4,145
  • 1
  • 32
  • 40
  • i tried that , it didnt work . The correct way to do it is ip.addr==x.x.x.x || ip.addr==y.y.y.y || ip.addr=z.z.z.z just got it to work after i posted my question . – helloworld0722 Jul 26 '12 at 16:21
  • I use it for 5 years in my project. Yours is Display Filter while mine example is capture filter. – Boris Ivanov Jul 26 '12 at 16:26