Wireshark · Ethereal-users: [Ethereal-users] Re: Display filter for broadcast/multicast ethernet

["Michael Kopp" <michael.kopp@xxxxxxx>]

Hi LEGO

>you might want to try 
>eth.dst[0:1} == 01 || eth.dst[0:1] == 03 ..
>... or ...
>eth.dst[0:1} == 01 or eth.dst[0:1] == 03 ..
>
>the '|' operator isn't a logical OR it's a bitwise OR.
>"xxx.flags | 0x0F" will be true if any of the four least significative
>bits of xxx.flags is set.

>> I tried "eth.dst[0:1} == 01 | eth.dst[0:1] == 03 ..." , but to catch all
>> valid broadcast combinations , the filter string gets far to long.

This was a typo in the mail, I indeed tried what you suggested (the ||
operator ) , but the problem is that the string to catch all possible
combinations is getting far too long to put into the display filter field or
into a coloring rule 

Regards
Michael

-- 
Sparen beginnt mit GMX DSL: http://www.gmx.net/de/go/dsl