In this lecture, we are going to learn how to filter traffic by IP address using IP address filter.
So if you want to find the packets that a particular IP address or addresses have sent or received,
then IP header filter can be used there.
It is a super handy filter.
So in the filter bar type IP dot adder two equal to sines.
Now write the IP address and let me type my own IP address.
192.
.68.
Now, this filter is going to display all the packets that contain this IP address or all the packets
that this particular IP address has sent or received.
Right.
So if I press enter now, you are going to see this IP address either under source or destination column.
As you can see here.
Right.
And of course, you can use our operator here to combine multiple IP addresses.
IP dot header.
And instead of writing a two equal to sines, we can use simply IQ.
It also means equal to.
Okay.
Now I'm going to specify another IP address.
This time, IP added with our operator, it is going to display all the packets that these two specified
IP addresses have sent or received.
Right.
Of course, in this way, guys, you can combine as many IP addresses as you like.
Now let me show you the use of and operator here.
So IP header equal to IP address then.
Right.
And UDP now what basically it means, I am telling Wireshark that show me only the UDP packets that
this particular IP address has sent and received.
So this filter will only display the packets that contain both UDP and this IP address.
This is how the end operator works.
Both the conditions must be true.
So first condition is that the packet must contain this IP address and second condition is packet also
needs to have UDP in it.
So if I press enter, as you can see guys under the protocol column, it is only displaying DNS and
other protocols that use UDP for the data transportation.
So let me click on let's say packet number six and pull the packet details up.
As you can see down here, we have the UDP protocol, right?
User datagram protocol here, both the conditions are true.
Right.
So first condition is that IP address must be this.
So if you check the internet protocol version for in the destination field, we have this specified
IP address and the protocol is UDP.
In the same way.
Let's say you only want to display the TCP packets that this particular IP address has sent or received.
Hit enter.
Now you are only going to see TCP packets that this specified IP address has sent or received.
Right.
Or we can use node operator here as well.
So if you type not IP header equal to this IP address, it means I am telling Wireshark that do not
show me packets that this particular IP address has sent or received.
So if I hit enter, as you can see guys under the source or destination column, you are not going to
see this IP address at all.
And if you want to negate traffic of multiple IP addresses, then you can specify those IP addresses
within the brackets using our operator, of course, or.
Okay.
Just like this.
Now it has removed packets that both the specified IP addresses have sent or received.
Right.
Now let's narrow down the IP adder filter.
If you are interested in packets that a particular IP address has sent, so write IP dot source.
This filter is only going to display the package that this IP address has sent.
So if I hit enter under the source column, as you can see, you are only going to see this IP address
or package that the specified IP address has sent.
And if you want to find the packets that an IP address has received, then replace source with DSD.
DSD means a destination.
Now, Wireshark is going to display the packets that this IP address has received.
So if I hit enter under the destination column, as you can see, we have the specified IP address.
So these are all the packets that the specified IP address has received.