Wireshark-users: Re: [Wireshark-users] capture filter

From: "Tom Greaser" <tgreaser@xxxxxxxxxxx>
Date: Fri, 04 May 2007 13:26:47 -0400

Thanks Guy.. JUST want i was asking for
i will remember to man tcpdump  next time ..
 
>>> Guy Harris <guy@xxxxxxxxxxxx> 05/04/07 12:18 PM >>> 
Tom Greaser wrote:

> How can i set my capture to allow me to put in just part of the
> ethernet address ?
> 
> i read the wiki and since i have HIGH volumes of data (gig links
> running at 15-50 meg)
> id like to do more than just the filter  "mulitcast"
> i will if i have too..
> 
> i know the source mac  always ends in 0007 

A capture filter of

	ether[10:2] == 0x0007

will check bytes 10 and 11 (the first byte being 0) of the packet 
against 00:07; that checks the last 2 bytes of the source MAC address.

See the tcpdump/WinDump man page for capture filter details; look for 
"expression" to find the description of filters, and look for "expr 
relop expr" for a description of the syntax of general comparisons such

as that.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users