Ethereal-users: Re: [Ethereal-users] display filter for multicast

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Gerald Combs <gerald@xxxxxxxxxxxx>
Date: Thu, 21 Jul 2005 09:31:21 -0500
Lars Scheffmann wrote:
> 
> I would like to make a display filter so I can extract all multicast and
> broadcast packets from a captured file.
> 
> It is possible to do this in capture filter with "ether multicast".
> 
> I know the "substring operator" but this operate on a byte, not on a bit.
> 
> Does it already exists, or can you help me?

Try "eth[0] & 1" for multicast frames and "eth.dst eq ff:ff:ff:ff:ff:ff"
for broadcast frames.  A detailed description can be found in the
"Display Filter" section of http://wiki.ethereal.com/Ethernet .