Which display filter shows packets where 192.168.1.2 is the source address?

• A. ip.src==192.168.1.2
• B. ip.addr==192.168.1.2
• C. ip.dst==192.168.1.2
• D. eth.src==192.168.1.2

Answer: (A)

To show packets where the IPv4 source is a specific address, use the ip.src field. The filter ip.src==192.168.1.2 selects only packets whose IP header source equals 192.168.1.2, giving exactly the packets that originate from that host. Other filters behave differently: ip.addr would match that address whether it’s the source or the destination, which isn’t what’s asked; ip.dst would match packets where that address is the destination; and eth.src filters the Ethernet layer’s source MAC address, not an IP address, so it wouldn’t match an IP address at all.