Display Filter Reference: Ethernet

Protocol field name: eth

Versions: 1.0.0 to 2.6.1

Back to Display Filter Reference

Field name Description Type Versions
eth.addr Address Ethernet or other MAC address 1.0.0 to 2.6.1
eth.addr_resolved Address (resolved) Character string 1.12.0 to 2.6.1
eth.dst Destination Ethernet or other MAC address 1.0.0 to 2.6.1
eth.dst_resolved Destination (resolved) Character string 1.12.0 to 2.6.1
eth.fcs Frame check sequence Unsigned integer, 4 bytes 1.8.0 to 2.6.1
eth.fcs.status FCS Status Unsigned integer, 1 byte 2.2.0 to 2.6.1
eth.fcs_bad Bad checksum Label 1.8.0 to 2.6.1
eth.fcs_bad.expert Expert Info Label 1.12.0 to 2.0.16
eth.fcs_good FCS Good Boolean 1.8.0 to 2.0.16
eth.ig IG bit Boolean 1.0.0 to 2.6.1
eth.invalid_lentype Invalid length/type Unsigned integer, 2 bytes 1.8.0 to 2.6.1
eth.invalid_lentype.expert Invalid length/type Label 1.12.3 to 2.6.1
eth.len Length Unsigned integer, 2 bytes 1.0.0 to 2.6.1
eth.len.past_end Length field value goes past the end of the payload Label 1.12.0 to 2.6.1
eth.lg LG bit Boolean 1.0.0 to 2.6.1
eth.padding Padding Sequence of bytes 1.8.0 to 2.6.1
eth.src Source Ethernet or other MAC address 1.0.0 to 2.6.1
eth.src_not_group Source MAC must not be a group address: IEEE 802.3-2002, Section 3.2.3(b) Label 1.12.0 to 2.6.1
eth.src_resolved Source (resolved) Character string 1.12.0 to 2.6.1
eth.trailer Trailer Sequence of bytes 1.0.0 to 2.6.1
eth.type Type Unsigned integer, 2 bytes 1.0.0 to 2.6.1
eth.vlan.cfi CFI Unsigned integer, 2 bytes 1.6.0 to 1.6.2
eth.vlan.id VLAN Unsigned integer, 2 bytes 1.6.0 to 1.6.2
eth.vlan.pri Priority Unsigned integer, 2 bytes 1.6.0 to 1.6.2
eth.vlan.tpid Identifier Unsigned integer, 2 bytes 1.6.0 to 1.6.2
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ NetShark appliance
  • • Troubleshoot problems faster
  • • Quickly identify the applications running on your network
  • • Monitor your virtual machine traffic
Learn More