How to filter by IP address in Wireshark?

Question

I tried dst==192.168.1.101 but only get :

Neither \"dst\" nor \"192.168.1.101\" are field or protocol names.

The following display filter isn\'t a          


        

Answer 1

If you only care about that particular machine's traffic, use a capture filter instead, which you can set under Capture -> Options.

host 192.168.1.101

Wireshark will only capture packet sent to or received by 192.168.1.101. This has the benefit of requiring less processing, which lowers the chances of important packets being dropped (missed).