Wireshark · Ethereal-users: [Ethereal-users] display filter for multicast

[Lars Scheffmann <scheffmann@xxxxxxxxxxxxxxxxx>]

I would like to make a display filter so I can extract all multicast and 
broadcast packets from a captured file.

It is possible to do this in capture filter with "ether multicast".

I know the "substring operator" but this operate on a byte, not on a bit.

Does it already exists, or can you help me?




Best regards

Security co-ordinator
Lars Scheffmann,                      E-Mail: scheffmann@xxxxxxxxxxxxxxxxx
Syddansk Universitet, IT-service      Direct: +45 6550 2867
Campusvej 55,  DK-5230  Odense M      Mobile: +45 6011 2867
Denmark                               Fax:    +45 6550 2860