Hi All,
I am struggling with how to take a Wireshark packet capture and filter out two (or more) MAC addresses.
I can filter out one MAC address using
!(eth.src == 00:01:12:23:34:45)
But I cannot write the correct filter to remove a second MAC. Read CHM Windows help and googled. To no avail.
THOUGHT I could filter out two MACs with similar
!(eth.src == 00:00:00:00:00:00:11:11:11:11:11:11)
or
!(eth.src == 00:00:00:00:00:00) || !(eth.src == 11:11:11:11:11:11)
I believe you can filter out two or more MAC addresses. But I lack the knowledge to do this. lol Has anyone written this filter? Reference?
ANY help is appreciated.
lt
------Original Message------
From: <wireshark-users-request@xxxxxxxxxxxxx>
To: <linuxtard@xxxxxxxxx>
Date: Thu, Aug 28, 2008 05:32 AM
Subject: Welcome to the "Wireshark-users" mailing list
Welcome to the Wireshark-users@xxxxxxxxxxxxx mailing list!
To post to this list, send your email to:
wireshark-users@xxxxxxxxxxxxx
General information about the mailing list is at:
https://wireshark.org/mailman/listinfo/wireshark-users
If you ever want to unsubscribe or change your options (eg, switch to
or from digest mode, change your password, etc.), visit your
subscription page at:
https://wireshark.org/mailman/options/wireshark-users/linuxtard%40yahoo.com
You can also make such adjustments via email by sending a message to:
Wireshark-users-request@xxxxxxxxxxxxx
with the word `help' in the subject or body (don't include the
quotes), and you will get back a message with instructions.
You must know your password to change your options (including changing
the password, itself) or to unsubscribe. It is:
bigmac1
Normally, Mailman will remind you of your wireshark.org mailing list
passwords once every month, although you can disable this if you
prefer. This reminder will also include instructions on how to
unsubscribe or change your account options. There is also a button on
your options page that will email your current password to you.