ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-users: Re: [Ethereal-users] Question about Capture Filters

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 27 Jul 2001 17:25:55 -0700 (PDT)
> So I’ve referenced the ethers.3N man page and really didn’t get the gist of
> how I should be formatting my MAC address entry.  I’ve tied x:x:x:x:x:x and
> x-x-x-x-x-x and xxxx.xxxx.xxxx to no avail.

The correct syntax, in capture filters, is, in fact, x:x:x:x:x:x; it
worked just fine on a machine here.

If the trouble (you didn't specify what *type* of trouble you were
having, so we can only guess what it might be, and thus can only guess
how to fix it) is that you're not seeing traffic to that host, perhaps
either

	1) you're not using the right destination address;

	2) there really *isn't* any traffic going to that MAC address on
	   your network segment;

	3) there is, but you're on a switched network, not on a port
	   that's mirroring all traffic, and none of the traffic to that
	   MAC address is coming from your machine;

	4) you're not running in promiscuous mode (try it with
	   Tethereal, and don't use the "-p" flag).