Merge filters


The optional merge filters are :

Wireshark pcap filter criteria

A specific filter is only active when the checkbox Wireshark pcap filter criteria on the left side is selected :

 ●  Only SIP : only the SIP messages and no other network traffic is kept in the merged output

 ●  Only this Date : only the packets on the specified Date are kept in the merged output

 ●  Only this Timeframe : only the packets between the Start and End time are kept in the merged output

 ●  Only these IP addresses : only the packets that belong to the list of the given network IP address ranges are kept in the merged output. How the IP address ranges can be entered is explained below.

 ●  No syslog : no syslog packets in the merged output


The syntax of the IP address range is as follows :

<IP address> [/<network prefix>] [<separator>] [<IP address>] [/<network prefix>] [<separator>]

The brackets [ ] indicate an optional element.


<IP address> is any valid IPv4 address. See also

The / character is to use a network prefix (see next).

<network prefix> is a whole number ranging from 0 to 32. The given number indicates the netmask where 0 stands for (all IP addresses) and 32 stands for (one single IP address).

Omitting the network prefix assumes one single IP address (equivalent with /32).

See also

<separator> can be a semicolon ; or comma ,


Examples of "Only these IP addresses" : means only one single IP address /16 means the network ranging from IP address to IP address /8 ; /12 ; /16 means the network ranges -, - and -


Back Back to Online Help