Wireshark-users: Re: [Wireshark-users] Capture filter for ethernet range

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Tue, 07 Nov 2006 22:29:21 -0500

Jack Jackson wrote:

Sure. It only captures destination packets because you are only checking the destination address. You need to also check for the source address. Assuming you want packets whose source or destination address is in the range:

(ether[0:4]>=0x00804400 and ether[0:4]<=0x008044ff) or
(ether[6:4]>=0x00804400 and ether[6:4]<=0x008044ff)

doh! Of course. Thanks. :)

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users