Wireshark · Ethereal-users: Re: [Ethereal-users] tethereal post capture filtering

[Guy Harris <gharris@xxxxxxxxx>]

M.N.A.Smadi wrote:

> i have a large number of libpcap dump files that I want to write a 
> script to filter.  I need some help with the following:
> Q: given a string value for a given field such as the mac address, i can 
> i filter for that?

	tethereal -R "eth.addr == 00:0a:00:08:02:04" -r {file} -w {output file}

will, for an Ethernet capture, read file {file} and write to file 
{output file} the packets that have a source or destination address of 
00:0a:00:08:02:04.  (Note that this will *only* work for Ethernet 
captures - you'd need to use "tr.addr" for Token Ring, "fddi.addr" for 
FDDI, "wlan.addr" for 802.11, etc..)

"-R" takes an arbitrary display filter string (in quotes) as an argument.