Re: [Ethereal-users] Display and Capture filters on IP address

[Heikki Vatiainen <hessu@xxxxxxxxx>]

"bejay" <mcdon18@xxxxxxxxxxxxxxx> writes:

> What is the easiest way of capturing and viewing certain IP addresses that
> have a range.

I answered your questions below, but please check the manual page for
more discussion and examples.

> For example
> 
> In a display filter how can I use a wild card if I want to show only 192.168
> 0.* cant seem to get
> the syntax right there and it does not like the ' * '.

ip.addr == 192.168.0.0/24 catches both source and destination
addresses.  ip.src or ip.dst considers only source or destination
address respectively.
 
> Similar for a Capture filter.....want a similar IP address where the last
> octet could change and want to select the whole range from 0-255.

net 192.168.0.0/24 works for both source and destination address in
the said range. For only source or destination try
 src net 192.168.0.0/24
or
 dst net 192.168.0.0/24

With capture filter you also use the mask keyword:
 src net 192.168.0.0 mask 255.255.255.0

-- 
Heikki Vatiainen                  * hessu@xxxxxxxxx
Tampere University of Technology  * Tampere, Finland