Ethereal-users: Re: [Ethereal-users] filtering mac address ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 26 Nov 2003 18:21:31 -0800
On Wed, Nov 26, 2003 at 06:09:50PM -0800, john g wrote:
> what is the filter expression for filtering based on
> mac address ?

For capture filters:

	ether host XX:XX:XX:XX:XX:XX

will only capture packets to or from MAC address XX:XX:XX:XX:XX:XX.

For display filters, it depends on the link-layer type; for Ethernet,

	eth.addr == XX:XX:XX:XX:XX:XX

will display packets to or from Ethernet address XX:XX:XX:XX:XX.