Wireshark · Ethereal-users: Re: [Ethereal-users] Display filter for broadcast/multicast ethernet

[Ulf Lamping <ulf.lamping@xxxxxx>]

Guy Harris wrote:

>
> so "eth.dst[0:1] & 1" should test the low-order bit of the first byte
> of the destination address, and match packets where that bit is set.
>
> Given that, "!(eth.dst[0:1] & 1)" should test that bit and match
> packets where it's *not* set, so that should be a display filter to
> show only unicast packets.

Hi!

The length field is not required for a single byte, so "eth.dst[0] & 1"
should do the same job.

I've added some more filters to the Ethernet wiki page:
http://wiki.ethereal.com/Ethernet

Regards, ULFL