Wireshark
the world's foremost network protocol analyzer
Wireshark-users: [Wireshark-users] filtering on Ethernet MAC OUI
From: "noah davids" <ndav1@xxxxxxx>
Date: Thu, 2 Apr 2009 19:30:48 -0700
|
Thank you everyone for your answers.
The eth.addr contains 00:02:fc filter worked fine
- BUT the
"eth.addr[0:2]==00:02:fc" failed to find any frames, even though the first 3 bytes were 00:02:fc. The filter "eth.addr[0-2]==00:02:fc" did find the same frames as the "contains" filter. The "[0:2]" would appear to be a valid filter (the bar was green) but what is it doing? I also discovered the following strangeness. The
filter
"eth.addr[2]==fc" turns red, it appears that "fc" is not valid by itself. I can enclose fc in quotes eth.addr[2]=="fc" and the filter turns green but it doesn't find any frames. The filter eth.addr[2] matches "fc" also fails to find any frames. The problem appears to be the "fc" value since using the same syntax with other bytes and values and not using quotes works - so how do I match on "fc". Noah Davids
=+=+=+=+=+=+=+=+=+=+=+=+=+=+ Serendipity is a function of bandwidth |
- Follow-Ups:
- Prev by Date: Re: [Wireshark-users] Conflicker GenB! Killed Wireshark
- Next by Date: Re: [Wireshark-users] Conflicker GenB! Killed Wireshark
- Previous by thread: Re: [Wireshark-users] filtering on Ethernet MAC OUI
- Next by thread: Re: [Wireshark-users] filtering on Ethernet MAC OUI
- Index(es):