>I have successfully made a capture. I know my subnet mask is 255.255.240.0, and that my ip address is 128.61.126.34. This gives me a range of 128.61.16.0 to 128.61.255.255. Your subnet is 128.61.112.0 to 128.61.127.255. For the third byte (the "split byte"): Min. 126= 0111 1110 126 & 240 = 0111 1110 & 1111 0000 = 0111 0000 = 64+32+16 = 112 Max. 126 | (^240) = 0111 1110 | 0000 1111 = 0111 1111 = 127 = 127 Bytes before the split byte are the same. The bytes after the split byte are 0 and 255 (for the min and max). >I am quite sure that this is correct, but could you verify? Also, is there a way to supply a range of ip addresses in the display filter of wireshark or do you expect us to count manually? You could do it manually. Outside addresses probably will not start with 128. Only a rough number is desired. A display filter could be used after the capture: To see local addresses: ip.addr>=128.61.112.0 and ip.addr<=128.61.127.255 To see non-local addresses: ip.addr<128.61.112.0 or ip.addr>128.61.127.255 Note the "and" and the "or". John Copeland