Tom Greaser wrote:
How can i set my capture to allow me to put in just part of the
ethernet address ?
i read the wiki and since i have HIGH volumes of data (gig links
running at 15-50 meg)
id like to do more than just the filter "mulitcast"
i will if i have too..
i know the source mac always ends in 0007
A capture filter of
ether[10:2] == 0x0007
will check bytes 10 and 11 (the first byte being 0) of the packet
against 00:07; that checks the last 2 bytes of the source MAC address.
See the tcpdump/WinDump man page for capture filter details; look for
"expression" to find the description of filters, and look for "expr
relop expr" for a description of the syntax of general comparisons such
as that.