Watch out for this "gotcha" when creating capture filters with subnet masking in CIDR format.
DISPLAY FILTERS ALLOW...
Display filters allow any numbers in the host portion of an IP address defined with CIDR formatting. For example, you could use ip.addr==1....... click here or the image for the full article
