Wireshark · Ethereal-users: Re: [Ethereal-users] display filter for multicast

[Gerald Combs <gerald@xxxxxxxxxxxx>]

Lars Scheffmann wrote:
> 
> I would like to make a display filter so I can extract all multicast and
> broadcast packets from a captured file.
> 
> It is possible to do this in capture filter with "ether multicast".
> 
> I know the "substring operator" but this operate on a byte, not on a bit.
> 
> Does it already exists, or can you help me?

Try "eth[0] & 1" for multicast frames and "eth.dst eq ff:ff:ff:ff:ff:ff"
for broadcast frames.  A detailed description can be found in the
"Display Filter" section of http://wiki.ethereal.com/Ethernet .