At 03:26 PM 11/7/2006, Andrew Schweitzer wrote:
I have an enthernet range I want to sniff (00:80:44:00:00:00 -
00:80:44:ff:ff:ff).
The following filter is legal, and sort of looks right, but only seems
to capture packets where the packet's ethernet *destination* is the
specified range.
(ether[0:4]>=0x00804400 and ether[0:4]<=0x008044ff)
Any ideas?
Sure. It only captures destination packets because you are only checking
the destination address. You need to also check for the source
address. Assuming you want packets whose source or destination address is
in the range:
(ether[0:4]>=0x00804400 and ether[0:4]<=0x008044ff) or
(ether[6:4]>=0x00804400 and ether[6:4]<=0x008044ff)