How to Define an IP Range with Wireshark
One of the keys to being an effective network troubleshooter when using a protocol analyzer is the ability to see patterns, which is where filters come into play. In this video, I review the two most common filters in Wireshark. Note that in Wireshark, display and capture filter syntax are completely different. A capture filter is configured prior to starting your capture and affects what packets are captured. A display filter is configured after you have captured your packets.
You may not know what to focus on when you capture packets, resulting in no capture filter. Even when you have a capture filter, it may be too generic. In either case, you will need to use a display filter to narrow the traffic down.
In this video, I respond to a question from one of my readers who wanted to create a display filter for many IP addresses. One time-consuming approach would be to literally type out all the addresses you want to filter on. However, if the addresses are contiguous or in the same subnet, you might be able to get away with a subnet filter.
The display filter syntax to filter out addresses between 192.168.1.1 – 192.168.1.255 would be ip.addr==192.168.1.0/24 and if you are comfortable with IP subnetting, you can alter the /24 to change the range.
Recommended For You
Low-Power WANs offer an alternative to 5G for connecting a fast-growing array of basic devices and sensors that transmit small amounts of data.
An effective network visibility strategy requires understanding the technical, financial, political, and legal aspects impacting your network operations.
Emerging organizational structures for IT include placement of IT pros in user areas and departments forming their own "micro IT's."
Comparing a good and bad trace helps identify performance issues. Dynamic baselining can be used when you do not have a good trace to reference.
Combining commodity server platforms and FPGA-based SmartNICs will allow network applications to operate at hundreds of gigabits of throughput with support for millions of simultaneous flows.
SD-WAN implementations are on the rise thanks to the potential cost savings, increased network resiliency, and better application performance they deliver.