Thanks Guy.. JUST want i was asking for
i will remember to man tcpdump next time ..
>>> Guy Harris <guy@xxxxxxxxxxxx> 05/04/07 12:18 PM >>>
Tom Greaser wrote:
> How can i set my capture to allow me to put in just part of the
> ethernet address ?
>
> i read the wiki and since i have HIGH volumes of data (gig links
> running at 15-50 meg)
> id like to do more than just the filter "mulitcast"
> i will if i have too..
>
> i know the source mac always ends in 0007
A capture filter of
ether[10:2] == 0x0007
will check bytes 10 and 11 (the first byte being 0) of the packet
against 00:07; that checks the last 2 bytes of the source MAC address.
See the tcpdump/WinDump man page for capture filter details; look for
"expression" to find the description of filters, and look for "expr
relop expr" for a description of the syntax of general comparisons such
as that.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users