But it is almost as if someone, somewhere is streaming audio and video 24/7. I expected use to drop drastically after business hours. On a recent fiber management report I noticed that our bandwidth and usage is fairly constant through all ours of the day. So, bandwidth, although limited, has never been a real concern from a usage perspective, but is now. The Fiber connection, unlike the Cable connection, is metered.

We recently switched from cable to a managed Fiber connection. Here is what I am trying to accomplish and the background reason why. If you could be more specific with you requirements I may be able to filter it to what you need.īrian, thank you for the suggestions. Unfortunately, contrary to many posts on here, broadcast traffic does make a lot of noise and is why VLANs should be used. The lack of broadcast and multicast traffic by itself will remove local traffic within your IP segment/VLAN. This will not show you traffic going to those IP addresses, so basically you'll only get traffic going to the internet, without the return traffic you won't be able to reassemble streams and will be missing a lot of the picture you need to know what's going on. You can set up a filter to eliminate traffic ranges, but when you say internet traffic, do you mean the destination being traffic leaving your network as you'll always have a local source address in this example.īut if you wish to block a range, lets say you want to block destination traffic going to all RFC 1918 IP addresses 10.0.0.0 /8, 172.16.0.0 /20 and 192.168.0.0 /16 you could use the following

I would like to utilize the capture filters in Wireshark but have not had any luck finding a filter that would eliminate all local LAN traffic and just show me the Internet traffic.

Wireshark capture filter by port