Ethereal-users: RE: [Ethereal-users] Sniffing MAC Addresses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date: Mon, 23 Dec 2002 17:38:52 -0000
Title: Message
Gregory,
 
Do you want to know how to filter the trace to only capture certain MAC addresses?
If so use a capture filter; eg "ether host 12:34:56:78:9A:BC".
 
Do you want to know how to display source and destination MAC address columns in the upper window?
If so then select Edit - Preferences. Click Columns, click "Add New". Then select Column format "HW Src addr (resolved)" and enter a column title of "Src MAC", repeat for "HW Dst Addr (resolved)" and then click Save and restart Ethereal (apply doesn't appear to work).
 
Do you want to know how to prevent ethereal from decoding packets beyond the MAC address?
I don't know how to do this explicitly, but you can always mung tethereal -V's output (IMHO one of the most useful features of tethereal).
tethereal -V | perl -e'$/="\nFrame";while(<>){print (/^(.*)Internet Protocol/sm)? $1 :$_}'
 
HTH,
 
Alistair 
 
 
 -----Original Message-----
From: Gregory Gordon [mailto:ggordon@xxxxxxxxxxxxxx]
Sent: 20 December 2002 05:47
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Sniffing MAC Addresses

Can someone give me some tips on how to sniff MAC addresses.  It seems like once I get to where I can sniff IP addresses, ports, and such, the MAC address has already been pulled apart at a lower level.  My question is more for programming a sniffer generally, but not specific to Ethereal. 
 
How, generally is it possible to sniff MAC addresses?
 
Any input or ideas would be greatly appreciated.  Thanks. 


Registered Office:
Marks & Spencer p.l.c
Michael House, Baker Street,
London, W1U 8EP
Registered No. 214436 in England and Wales.

Telephone (020) 7935 4422
Facsimile (020) 7487 2670

www.marksandspencer.com

Please note that electronic mail may be monitored.

This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.

The registered office of Marks and Spencer Financial Services PLC, Marks and Spencer Unit Trust Management Limited, Marks and Spencer Life Assurance Limited and Marks and Spencer Savings and Investments Limited is Kings Meadow, Chester, CH99 9FB.