How to filter by IP address in Wireshark?

Question

I tried dst==192.168.1.101 but only get :

Neither \"dst\" nor \"192.168.1.101\" are field or protocol names.

The following display filter isn\'t a          


        

Answer 1

You can also limit the filter to only part of the ip address.

E.G. To filter 123.*.*.* you can use ip.addr == 123.0.0.0/8. Similar effects can be achieved with /16 and /24.

See WireShark man pages (filters) and look for Classless InterDomain Routing (CIDR) notation.

... the number after the slash represents the number of bits used to represent the network.