Wireshark-users: Re: [Wireshark-users] capture filter

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 04 May 2007 09:18:39 -0700

Tom Greaser wrote:

How can i set my capture to allow me to put in just part of the
ethernet address ?

i read the wiki and since i have HIGH volumes of data (gig links
running at 15-50 meg)
id like to do more than just the filter  "mulitcast"
i will if i have too..

i know the source mac always ends in 0007

A capture filter of

	ether[10:2] == 0x0007

will check bytes 10 and 11 (the first byte being 0) of the packet against 00:07; that checks the last 2 bytes of the source MAC address.

See the tcpdump/WinDump man page for capture filter details; look for "expression" to find the description of filters, and look for "expr relop expr" for a description of the syntax of general comparisons such as that.