top of page
Writer's pictureLaura Chappell

Wireshark Tip: Filtering on Subnet Addresses

Watch out for this "gotcha" when creating capture filters with subnet masking in CIDR format.


DISPLAY FILTERS ALLOW...

Display filters allow any numbers in the host portion of an IP address defined with CIDR formatting. For example, you could use ip.addr==10.2.2.2/16 - Wireshark interprets this display filter as "display packets that contain the source or destination IP address starting with 10.2."


display filter for 10.2.2.2/16

Even though we don't care about the last 2.2 portion of that address, we can keep it in our display filter - the /16 indicates we only care about the address's first 16 bits (2 bytes) anyway.


CAPTURE FILTERS ARE PICKIER...

Capture filters use BPF (Berkeley Packet Filtering) format and do not allow anything other than zeroes in the host portion of the filter when using CIDR formatting. For example, the capture filter net 10.2.2.2/16 will leave you with a red background and the inability to start a capture.


capture filter net 10.2.2.2/16 red background

Instead, you must either fill the address's host portion with zeros...

capture filter 10.2.0.0/16 green background

or drop that host portion altogether.

capture filter net 10.2/16 green background

Cheers!


-Laura




Comments


bottom of page