In this lecture, we are going to learn to capture traffic by IP address.
Let's say you want to capture traffic that a particular IP address or multiple IP addresses send or
receive.
Then we can use capture, filter, host data.
So go to the capture options and select the network interface.
Then down here, write the host.
Now specify the IP address.
You can specify both IPv4 address and IPV six host filter supports both.
I'm going to specify my own IPv4 address.
Now this filter is only going to capture the traffic that this particular IP address sends and receives.
Right.
So let me click on START.
Now, as you can see, guys at the top capturing from wi fi, this is the host and you will see this
specified IP address either under source column or destination.
Right.
As you can see.
Now back to the capture options.
Now, let's say your device and server use IPV six address to communicate.
In that case, Wireshark will not be able to completely monitor traffic of this particular device because
if the device uses IPV six to communicate, then this filter is going to ignore the IPV six traffic.
So to completely monitor your device, you have to specify the IPV six address as well, right?
All you have to do combine the both IPV four and IPV six address and to combine multiple filters, we
use our of course, so type or and host.
Now specify the IPV six address.
So let me grab my own IPV six address.
No, let me paste it here.
Now, this filter is going to, you know, capture all the IPV six and IPV four packets that the specified
IP addresses send and receive.
Right.
Now, let's take another scenario.
Let's say you only want to capture FTP packets that this particular IP address sends and receives.
In that case, we can use and operate.
So if I type and now let's say port FTP.
Now this filter is only going to capture FTP traffic on this particular IP address.
Now let's narrow down the host filter.
So type source host.
Now this filter is only going to capture the packets that this specified IP address sends out.
Right.
It will not capture packets that will be delivered to this IP address, only the packets that this IP
address sends out.
So if I click on start now, as you can see, it's under the source column.
You are only going to see the specified IP address.
So it is only capturing the packets that this IP address has sent out or is sending out.
And in the same way you can capture the traffic that a particular IP address receives, just replace
as RC with DSD as RC means source, the SD means destination.
Now this filter is only going to capture the traffic that this specified IP address receives.
So let me click on START.
Now under the destination column, you are only going to see the specified IP address.
One 92.68.
Right.
No, wait.
Instead of writing IP address, we can also specify the U, r, l or domain name.
So if I type, let's say host host w w w dot reddit dot com.
Now this filter is only going to capture the traffic that comes in from Reddit dot com or whatever host
you specify.
So let me start capturing a packets and I'm going to refresh the Wikipedia.
As you can see, guys, it is not capturing any traffic from host Wikipedia.
Now let me visit Reddit dot com.
Now, as you can see, Wireshark is capturing the traffic, you know, which is coming in from the specified
host.
Reddit dot com.
Right.
And in the same way you can specify multiple hosts, all you have to do is use the OR operator WW dot
now google dot com or Wikipedia dot com.
Sometimes Wireshark takes a little time to validate the CAPTCHA filters.
Now this filter is going to capture all the traffic that comes in from these specified, you know,
hosts Wikipedia, Google and Reddit.
So in this way, you can combine as many hosts as you like.