Wireshark-users: Re: [Wireshark-users] Capture Filter for Country

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 30 Mar 2009 11:40:23 -0700

On Mar 30, 2009, at 11:28 AM, Gerald Combs wrote:


Ron Gallimore wrote:

Is it possible to create a capture filter to exclude any US IP
addresses? I am using Wireshark 1.1.2 with the GeoIP database loaded. 

You should be able to use something like

   ip and not ip.geoip.country == "United States"

or

   ip.geoip.country and not ip.geoip.country == "United States"


...which works as a display filter, but not a capture filter.