The display filter syntax to filter out addresses between 192.168.1.1 – 192.168.1.255 would be ip.addr=192.168.1.0/24 and if you are comfortable with IP subnetting, you can alter the /24 to change the range.

However, if the addresses are contiguous or in the same subnet, you might be able to get away with a subnet filter. Location of the display filter in Wireshark. This is where you type expressions to filter the frames, IP packets, or TCP segments that Wireshark displays from a pcap. One time-consuming approach would be to literally type out all the addresses you want to filter on. The Wireshark Display Filter Wireshark's display filter a bar located right above the column display section. In this video, I respond to a question from one of my readers who wanted to create a display filter for many IP addresses. In either case, you will need to use a display filter to narrow the traffic down. Even when you have a capture filter, it may be too generic. You may not know what to focus on when you capture packets, resulting in no capture filter. A display filter is configured after you have captured your packets. A capture filter is configured prior to starting your capture and affects what packets are captured.

Note that in Wireshark, display and capture filter syntax are completely different. In this video, I review the two most common filters in Wireshark. One of the keys to being an effective network troubleshooter when using a protocol analyzer is the ability to see patterns, which is where filters come into play.

Wireshark display filter multiple