Revision history  [back]

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.

If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.

If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the ip.src or ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.

If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH the ip.src and ip.dst fields, then the following display filter will accomplish that request.

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} || ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})

If using Wireshark version 4.0+, the above display filter will eliminate the packets with RFC1918 addresses in EITHER the EITHERip.src the ip.src or orip.dst ip.dst fields. Keep in mind you will still see broadcast/multicast, L2 protocols, and IPv6 traffic. You'll need to add those to the negated statement if you don't wish to see that traffic.

If you are wanting to only eliminate traffic that contains RFC1918 address in BOTH BOTH the ip.src and ip.dst ip.src and ip.dst fields, then the following display filter will accomplish that request.

!(ip.src in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16} && ip.dst in {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16})