Wireshark capture filter to isolate network traffic

Could anyone please advise me what the correct Wireshark capture filter would be to monitor traffic going to and from any given network ?  I am not sure what the filter string would be.

Thanks in advance.
Who is Participating?
DonConsolioConnect With a Mentor Commented:
capture filter:

all traffic from and to net "net"
all traffic going to net "dst net"
all traffic coming from net "src net"
InderjeetjaggiConnect With a Mentor Commented:
Check if below white paper help you:
Capturing Network Traffic With Wireshark
cdowdyConnect With a Mentor Commented:
Check out this link for the ethanalyzer built into the nexus 7000. It shows multiple examples for building filters and since it uses the same source, the  filters are the same as in wireshark. It also has a link to the wireshark users guide on page 5 of the pdf.


WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

naykamConnect With a Mentor Commented:
IP:     ip.src== and ip.dst==
          ip.src == or ip.dst ==

Port:    tcp.port eq 25 or icmp

rfc1180Connect With a Mentor Commented:
giltjrConnect With a Mentor Commented:
Wireshark actually does not capture the traffic.  The part that captures the traffic uses the same filter at tcpdump:


most of the filters given here that have ip.src==, ip.dst==, or ip.addr== are all Wireshark display filters, not capture filters.

A caputer filter for a network would be something like:

    ip net mask


    ip net

would both capture all ip traffic that is to or from any host with an IP address in the range of

Please note to use wireshark to capture traffic for more than traffic to/from your computer you need to be running the capture in a way that you see the traffic you want to capture.  Such as having a NIC on your computer connected to a mirror port.

SuncoreAuthor Commented:
Thanks all - much appriciated and just the answers I was looking for.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.