Wireshark-users: Re: [Wireshark-users] Traffic bewteen two IP addresses

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 28 Aug 2008 18:15:44 -0400


Bryan Carter wrote:
This one is just getting away from me and I can�t get my head around it, and I cannot find an example anywhere.

I have WireShark running on a SPAN port that is watching several ports on a Cisco switch. I simply want a capture filter that will allow me to see ALL of the traffic between two SPECIFIC ip addresses. So I ONLY want to see traffic from IP1, IF it is going to, or coming from IP2. What would that CAPTURE filter look like?

host IP1 and host IP2

should work.