Wireshark IP Address Not Equal: A Guide for DELL Machines

When analyzing network traffic using Wireshark, it is often necessary to filter out packets that do not match specific criteria. One common use case is to restrict the display to only packets from a specific device manufacturer. For DELL machines, this can be achieved by setting the `eth.addr` field to `00:06:5B`.

In addition to filtering by device manufacturer, Wireshark also provides the ability to filter on the vendor identifier part (OUI) of the MAC address using the `slice` feature. This can be useful for matching homegrown packet protocols.

Another common use case is to match packets containing a specific byte sequence in the UDP payload. For example, the Sasser worm used the 3-byte sequence `0x81, 0x60, 0x03` at the beginning of the UDP payload. Wireshark allows you to filter on this sequence using the `udp` field.

In some cases, it may be necessary to filter out noise while watching specific types of traffic. For example, when monitoring Windows Client-DC exchanges, it can be useful to filter out unnecessary protocols such as SMB, NBNS, DCERPC, NBSS, and DNS.

Finally, Wireshark provides the ability to filter on IP addresses using the `ip.src` and `ip.dst` fields. For example, you can show only traffic in a specific LAN by setting the source and destination IP addresses to `192.168.0.0/16`.

Here are some examples of Wireshark display filters:

* Show only packets containing the 3-byte sequence `0x81, 0x60, 0x03` at the beginning of the UDP payload: `udp=81:60:03`

* Filter out Windows traffic and show only SMTP (port 25) and ICMP traffic: `tcp.port eq 25 or icmp`

* Show only traffic in a specific LAN between workstations and servers: `ip.src=192.168.0.0/16 and ip.dst=192.168.0.0/16`

It's important to note that capture filters are not the same as display filters. Capture filters, such as `tcp port 80`, are used to control what packets are captured by Wireshark, while display filters, such as `tcp.port = 80`, are used to filter the display of captured packets.

By using these Wireshark display filters, you can quickly and easily analyze network traffic and identify specific types of packets or protocols.

Wireshark ip address not equal