["M Holt" <m.iostreams@xxxxxxxxx>]

Searched quite a bit on this, but not finding the answer...

When filtering captures in wireshark, is there a way to specify "this address" or "that address"?

Something like:

ip.addr == ( 1.1.1.1 or 2.2.2.2 )

I am looking for something shorter than:

ip.addr == 1.1.1.1 or ip.addr == 2.2.2.2

From tcpdump, I can capture like so:

tcpdump -ni eth0 host \( 1.1.1.1 or 2.2.2.2 \)

thank you in advance,

Michael