– create a function to 'postdissect' each frameįunction endpoints_proto. Wireshark filter for filtering both destination-source IP address and the protocol. Src_F = ProtoField.string('ip.addr','Source')ĭst_F = ProtoField.string('ip.addr','Destination') Once by Wireshark’s display filter engine and again by the PCRE2 library. However, if the addresses are contiguous or in the same subnet, you might be able to get away with a Wireshark subnet filter. Filter by IP address: ip.addr x.x.x.x, where x.x.x.x is the IP address you want to filter 2. One time-consuming approach would be to literally type out all the addresses you want to filter by.

Here are some common types of filters that you can use in Wireshark: 1. At last, I have written a Lua post-dissector that match my needs, adapted from the 'trivial' pseudo-protocol seen in the Lua tutorial it adds an 'Endpoints' element to the tree, that permits to 'Prepare' an ip.addr filter : - ip-addr postdissector exampleĮndpoints_proto = Proto('endpoints','Endpoints list') Filters can be based on various criteria, such as IP addresses, protocols, port numbers, and packet contents. Wireshark and TShark share a powerful filter engine that helps remove the noise from a packet trace and lets you see only the packets that interest you.

Wireshark filter by source ip address