!ip.addr =192.168.0.1 Display traffic between two specific subnet Icmp Exclude IP address: remove traffic from and to IP address Ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name Ip.dst = 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination Ip.src = 192.168.0.1 Filter by destination: display traffic only form IP destination Ip.addr = 192.168.1.1 Filter by source address: display traffic only from IP source Filter by IP address: displays all traffic from IP, be it source or destination Bellow is a list of the most common type of filtering. The filtering capabilities are very powerful and complex, there are so many fields, operators and options and their combination becomes overwhelming. Fortunately, wireshark has display filters so that we can search for specific traffic or filter out unwanted traffic, so that our task becomes easier. I answered question 5 correctly so I think I'm on the right track and I've done all the other Wireshark labs with similar filters and haven't had any problems with percentages.Wireshark takes so much information when taking a packet capture that it can be difficult to find the information needed. I've tried other variations too, total packets 10594 and displayed is 86 so i've tried. I used the filter (http.request or = 1 or tcp.flags eq 0x0002) and !(tcp.port eq 25)Ĩ% is displayed in the bottom right but it won't accept my answer. What percentage of results are then displayed in the capture?

Now take the filter used in the previous question, and add an OR expression which filters by (.tcp flags equal to 0x0002) and a further expression which filters by packets NOT from (tcp port 25). I've tried other variations too, total packets 10594 and displayed is 37 so i've tried. I used the filter (http.request or = 1) stated in the question itself and 3% is displayed in the bottom right but it won't accept my answer.

From the PCAP provided, apply a filter to display all web traffic (http.request or = 1). I cannot get the answer to questions 3 or 5 and I don't know what I'm doing wrong.ģ.

Wireshark display filter or