Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?


Both have mechanisms for filtering your capture, but you'll need to create a filter in the expected syntax (BPF) rather than just providing a list of IP addresses to include or exclude.

Wireshark has the additional capability of filtering the displayed packets while capturing all of them. The syntax for this is different.

https://wiki.wireshark.org/CaptureFilters https://www.wireshark.org/docs/wsug_html_chunked/ChWorkDefineFilterSection.html http://www.tcpdump.org/manpages/pcap-filter.7.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.