Merge filters

 

The optional merge filters are :

Wireshark pcap filter criteria

A specific filter is only active when the checkbox Wireshark pcap filter criteria on the left side is selected :

 ●  Only SIP : only the SIP messages and no other network traffic is kept in the merged output

 ●  Only this Date : only the packets on the specified Date are kept in the merged output

 ●  Only this Timeframe : only the packets between the Start and End time are kept in the merged output

 ●  Only these IP addresses : only the packets that belong to the list of the given network IP address ranges are kept in the merged output. How the IP address ranges can be entered is explained below.

 ●  No syslog : no syslog packets in the merged output

 

The syntax of the IP address range is as follows :

<IP address> [/<network prefix>] [<separator>] [<IP address>] [/<network prefix>] [<separator>]

The brackets [ ] indicate an optional element.

 

<IP address> is any valid IPv4 address. See also https://en.wikipedia.org/wiki/IPv4

The / character is to use a network prefix (see next).

<network prefix> is a whole number ranging from 0 to 32. The given number indicates the netmask where 0 stands for 0.0.0.0 (all IP addresses) and 32 stands for 255.255.255.255 (one single IP address).

Omitting the network prefix assumes one single IP address (equivalent with /32).

See also https://en.wikipedia.org/wiki/IP_address#Network_prefix

<separator> can be a semicolon ; or comma ,

 

Examples of "Only these IP addresses" :

10.20.30.40 means only one single IP address 10.20.30.40

10.20.0.0 /16 means the network ranging from IP address 10.20.0.0 to IP address 10.20.255.255

10.0.0.0 /8 ; 172.16.0.0 /12 ; 192.168.0.0 /16 means the network ranges 10.0.0.0 - 10.255.255.255, 172.16.0.0 - 172.31.255.255 and 192.168.0.0 - 192.168.255.255.

 

Back Back to Online Help