0

In Wireshark I can successfully create this display filter that will only show traffic going to x.x.x.x

ip.dst==x.x.x.x

But how do I create a corresponding capture filter?

E.g. if I remove all display filters and add this capture filter:

ip host x.x.x.x

and then restart the capture I still see tons of other destination IPs.

Am I doing something wrong or is it not possible to limit destination IP for a capture filter?

3

the filter ip host x.x.x.x is not correct. Wireshark accept it, but it seems it take into account only ip

host x.x.x.x match either source or destination IP address x.x.x.x (useful to see traffic sent and received by an host, since most network communication are bi-directional).

If you want only destination host you should use dst host x.x.x.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.