wireshark filter source and destination ip

If you could be more specific with you requirements I may be able to filter it to what you need.īrian, thank you for the suggestions. Unfortunately, contrary to many posts on here, broadcast traffic does make a lot of noise and is why VLANs should be used. The lack of broadcast and multicast traffic by itself will remove local traffic within your IP segment/VLAN. This will not show you traffic going to those IP addresses, so basically you'll only get traffic going to the internet, without the return traffic you won't be able to reassemble streams and will be missing a lot of the picture you need to know what's going on. You can set up a filter to eliminate traffic ranges, but when you say internet traffic, do you mean the destination being traffic leaving your network as you'll always have a local source address in this example.īut if you wish to block a range, lets say you want to block destination traffic going to all RFC 1918 IP addresses 10.0.0.0 /8, 172.16.0.0 /20 and 192.168.0.0 /16 you could use the following

I would like to utilize the capture filters in Wireshark but have not had any luck finding a filter that would eliminate all local LAN traffic and just show me the Internet traffic.

Wireshark filter source and destination ip