Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, the application I am capturing on is spread of a 'bucket' of IP addresses/servers, of which other applications are based within the same range. See my example:

  • ECommerce App Servers:,, - This is what I want to capture on (filtered on these exact IPs) I have tried 'host host' etc.
  • There are other applications within this range, e.g. PayRoll App is on, and I don't want to see any of this in my capture. Therefore 'net' to capture the whole range will not work for me.

Can anyone provide me the syntax? Is it even possible?

share|improve this question
up vote 2 down vote accepted

I just tested

host or host

as a capture filter in a wireshark session and it did what you ask (selected all traffic to or from either of those addresses). You can continue to add host a.b.c.d requirements, if you need to.

share|improve this answer
Beautiful, thanks. – Derek Jun 13 '11 at 15:20
Forgive me for noting this, but I see you're new to the site, and this is your first question. If you're happy with this answer, you should accept it by clicking the "tick" outline you see next to it. This not only improves my reputation but makes sure that you develop a reputation as someone who accepts answers to all the questions he asks - which is just as important. – MadHatter Jun 13 '11 at 15:22
..and I see you have done - thanks, and good luck on SF! – MadHatter Jun 13 '11 at 15:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.