Capture Filter with Wildcard in IP Address

Question

I am trying to customize Wireshark capture such that is captures all IP addresses (both source and destination) with the IP address format xxx.xxx.xxx.100.

I used the following Capture Filter

ip matches /.*/.*/.*/.100

but the text box remains red'

These are not IP addresses in a particular range, just the fourth octet is 100

Solution

Your regex is a little off, as you need to use a backslash to escape the periods. Try this:

ip.host matches "\.100$"

That should match .100 at the end of the string.

Source: http://ask.wireshark.org/questions/22230/filter-for-partial-ip-address

Edit: Try using the Display Filter (Analyze->Display Filters..), not the Capture Filter

Comments

[Glowie]

I tried this, box remains red, and when I attempt to run capture, I get error, "That string looks like a valid display filter; however, it isn;t a valid capture filter (syntax error)." When I google "wireshark capture filter ip address wildcard" I get the same website you posted, and other websites, but none that help :-(

[admdrew]

See my edit just now; like your error says, it's a display filter that this will work for, not the capture filter. I confirmed my string above works now as a display filter.

[Glowie]

If I capture traffic for 15 seconds, I get only one or two IP addresses in the format xxx.xxx.xxx.100. But if I run capture for few minutes the capture file reaches few GIGs. However if I am able to use a Capture Filter to only capture IP address xxx.xxx.xxx.100, it will save lot of disk space ...