Wireshark display filter to eliminate every address except one in a large subnet
Goal - display packets between 152.23.158.1 and external addresses where the internal subnet is defined as 152.16.0.0/12. This is difficult because 152.23.158.1 falls inside 152.16.0.0/12.
The following display filter works:
not (ip.src==152.23.158.1 and ip.dst==152.16.0.0/12) and not (ip.dst==152.23.158.1 and ip.src==152.16.0.0/12)