Wireshark · Ethereal-users: Re: [Ethereal-users] Display filter for broadcast/multicast ethernet

[LEGO <luis.ontanon@xxxxxxxxx>]

you might want to try 
eth.dst[0:1} == 01 || eth.dst[0:1] == 03 ..
... or ...
eth.dst[0:1} == 01 or eth.dst[0:1] == 03 ..

the '|' operator isn't a logical OR it's a bitwise OR.
"xxx.flags | 0x0F" will be true if any of the four least significative
bits of xxx.flags is set.

`On Apr 10, 2005 1:19 AM, Michael Kopp <michael.kopp@xxxxxxx> wrote:
> Hi,
> I`d like to create a display filter for ethernet packets where the Broadcast
> bit is set (first byte , lowest bit set)
> as a capture filter this is easy done with "ether multicast"
> but as a capture filter it seems not to be possible, am I right
> (Actually I want to have a coloring rule for that, so the capture filter
> doesnt help me in my situation)
> 
> I tried "eth.dst[0:1} == 01 | eth.dst[0:1] == 03 ..." , but to catch all
> valid broadcast combinations , the filter string gets far to long.
> 
> So I just wanted to check if I`m right with my assumption that it is
> currently not possible ?
> 
> Regards
> Michael
> 
> --
> Sparen beginnt mit GMX DSL: http://www.gmx.net/de/go/dsl
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> 


-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan