Wireshark capture filter from list file

Question

Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?

Answer 1

Both have mechanisms for filtering your capture, but you'll need to create a filter in the expected syntax (BPF) rather than just providing a list of IP addresses to include or exclude.

Wireshark has the additional capability of filtering the displayed packets while capturing all of them. The syntax for this is different.

https://wiki.wireshark.org/CaptureFilters https://www.wireshark.org/docs/wsug_html_chunked/ChWorkDefineFilterSection.html http://www.tcpdump.org/manpages/pcap-filter.7.html