Wireshark中如何按IP地址过滤？
我尝试了 dst==192.168.1.101 但只得到：
Neither "dst" nor "192.168.1.101" are field or protocol names.
The following display filter isn't a valid display filter:
dst==192.168.1.101
I tried dst==192.168.1.101 but only get :
Neither "dst" nor "192.168.1.101" are field or protocol names.
The following display filter isn't a valid display filter:
dst==192.168.1.101
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
匹配目的地：
ip.dst == xxxx匹配源：
ip.src == xxxx匹配其中之一：
ip.addr == xxxxMatch destination:
ip.dst == x.x.x.xMatch source:
ip.src == x.x.x.xMatch either:
ip.addr == x.x.x.xWireshark 中过滤 IP 地址：
(1)单个 IP 过滤：
ip.addr==XXXX
ip.src==XXXX
ip.dst==XXXX
(2)基于逻辑条件的多个 IP 过滤：
OR 条件：
(ip.src= =192.168.2.25)||(ip.dst==192.168.2.25)
AND 条件:
(ip.src==192.168.2.25) && (ip.dst==74.125.236.16)
Filtering IP Address in Wireshark:
(1)single IP filtering:
ip.addr==X.X.X.X
ip.src==X.X.X.X
ip.dst==X.X.X.X
(2)Multiple IP filtering based on logical conditions:
OR condition:
(ip.src==192.168.2.25)||(ip.dst==192.168.2.25)
AND condition:
(ip.src==192.168.2.25) && (ip.dst==74.125.236.16)
您还可以将过滤器限制为仅部分 IP 地址。
EG 要过滤
123.*.*.*，您可以使用ip.addr == 123.0.0.0/8。使用/16和/24也可以实现类似的效果。请参阅 WireShark 手册页（过滤器） 并查找无类域间路由 (CIDR) 表示法。
You can also limit the filter to only part of the ip address.
E.G. To filter
123.*.*.*you can useip.addr == 123.0.0.0/8. Similar effects can be achieved with/16and/24.See WireShark man pages (filters) and look for Classless InterDomain Routing (CIDR) notation.
如果您只关心该特定计算机的流量，请改用捕获过滤器，您可以在捕获 -> 下设置它。选项。
Wireshark 只会捕获发送到 192.168.1.101 或由 192.168.1.101 接收的数据包。这样做的好处是需要较少的处理，从而降低了重要数据包被丢弃（丢失）的可能性。
If you only care about that particular machine's traffic, use a capture filter instead, which you can set under
Capture -> Options.Wireshark will only capture packet sent to or received by
192.168.1.101. This has the benefit of requiring less processing, which lowers the chances of important packets being dropped (missed).尝试
Try
实际上，出于某种原因，wireshark 使用两种不同类型的过滤器语法，一种用于显示过滤器，另一种用于捕获过滤器。显示过滤器仅用于查找某些仅用于显示目的的流量。就好像您对所有流量感兴趣，但现在您只想查看具体流量。
但是如果您只对某些流量感兴趣并且根本不关心其他流量，那么您可以使用捕获过滤器。
显示过滤器的语法是（如前所述）
ip.addr = xxxx或者
ip.src = xxxx或者
ip.dst = xxxx但上述语法在捕获过滤器中不起作用，以下是过滤器
主机 xxxx，
请参阅 wireshark 维基页面
Actually for some reason wireshark uses two different kind of filter syntax one on display filter and other on capture filter. Display filter is only useful to find certain traffic just for display purpose only. its like you are interested in all trafic but for now you just want to see specific.
but if you are interested only in certian traffic and does not care about other at all then you use the capture filter.
The Syntax for display filter is (as mentioned earlier)
ip.addr = x.x.x.xor
ip.src = x.x.x.xor
ip.dst = x.x.x.xbut above syntax won't work in capture filters, following are the filters
host x.x.x.x
see more example on wireshark wiki page
在我们的使用中，我们必须使用主机 xxxx 或（vlan 和主机 xxxx）进行捕获，
否则将无法捕获？我不知道为什么，但这就是它的工作原理！
in our use we have to capture with host x.x.x.x. or (vlan and host x.x.x.x)
anything less will not capture? I am not sure why but that is the way it works!
其他答案已经介绍了如何按地址过滤，但如果您想排除地址，请使用
ip.addr < 192.168.0.11Other answers already cover how to filter by an address, but if you would like to exclude an address use
ip.addr < 192.168.0.11