Ethereal-users: Re: [Ethereal-users] Display filter for broadcast/multicast ethernet

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Sun, 10 Apr 2005 12:31:52 +0200
Guy Harris wrote:

>
> so "eth.dst[0:1] & 1" should test the low-order bit of the first byte
> of the destination address, and match packets where that bit is set.
>
> Given that, "!(eth.dst[0:1] & 1)" should test that bit and match
> packets where it's *not* set, so that should be a display filter to
> show only unicast packets.

Hi!

The length field is not required for a single byte, so "eth.dst[0] & 1"
should do the same job.

I've added some more filters to the Ethernet wiki page:
http://wiki.ethereal.com/Ethernet

Regards, ULFL