Re: [Ethereal-users] limit packet capture by source ip address

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 5, 2003, at 11:50 AM, Andrew Sudron wrote:

> Hi, I've just installed ethereal and am getting to
> grips with it. Would someone be so kind as to tell me
> how to limit packet capture by source ip address.
>
> I know you can use the string ip.src == 192.168.1.1

No, you can't, actually - you have to use the string "ip host 
192.168.1.1", if you truly mean "limit packet *capture*", rather than 
"limit the display of the packets you've already captured".  Capture 
filters and display filters are different.

> but which menu options do you use to enable this?

There isn't one.  You just enter that string in the "Filter:" field in 
the dialog box popped up by "Start" on the "Capture" menu.