Ethereal-users: Re: [Ethereal-users] Excluding MAC Addresses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 31 Oct 2003 01:16:32 -0800
On Thu, Oct 30, 2003 at 04:12:45PM -0600, Nick J Marques wrote:
> We are using Ethreal to sniff for computers with viruses on our LAN by
> filtering for ARP Packets. How can I tell Ethereal to EXCLUDE Mac
> Addresses we have already logged??

"Exclude" as in "ignore packets from or to those MAC addresses?

If so, then, once you have those addresses, you'd use a capture filter
such as

	not ether host XX:XX:XX:XX:XX:XX and not ether host
	    YY:YY:YY:YY:YY:YY ...