This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am using Wireshark 1.6.9 currently, but have no particular requirement to use that version and plan to upgrade at some point anyway. I know that I can filter on a specific Ethernet MAC address using the capture filter ether host 00:04:a3:00:00:00. Furthermore, I know I can filter on a particular IP subnet with ip net 10.0.0.0/24. Is there a similar capture filter syntax for Ethernet MAC addresses?

For example, ether net 00:04:a3:00:00:0/24 would capture only those packets with a Microchip MAC address, but it gets rejected by the capture filter dialog. How can I capture only traffic sourced from or destined to an Ethernet MAC with a given prefix?

asked 15 Aug '12, 15:47

multipleinterfaces's gravatar image

multipleinte...
1.3k152340
accept rate: 12%


There are no keywords that let you do that, but you can accomplish what you want with a byte offset filter. I was able to limit my capture to traffic to and from Netopia devices (OUI 00:0f:cc) with:

(ether [0:4] & 0xffffff00 = 0x000fcc00) or (ether [6:4] & 0xffffff00 = 0x000fcc00)

This was only a first attempt for me at using byte offset notation in a capture filter, so maybe someone can shorten the syntax. The problem I ran into was that we're trying to examine three bytes, but the length value in a capture filter byte offset expression can only be 1, 2, or 4 bytes. So "ether[0]" is valid, as is "ether[0:2]" or "ether[0:4]" but not "ether[0:3]". This filter uses "ether[0:4]" and "ether[6:4]" to examine the first four bytes of the destination MAC address and source MAC address, but then uses "& 0xffffff00" to mask the fourth byte before making the comparison.

You could also just examine each byte individually:

(ether[0]=0x0 and ether[1]=0x0f and ether[2]=0xcc) or (ether[6]=0x0 and ether[7]=0x0f and ether[8]=0xcc)

This is a longer and more awkward looking filter, but you might finder it easier to create since the comparison logic is more straightforward.

permanent link

answered 15 Aug '12, 19:51

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×184
×87
×40

question asked: 15 Aug '12, 15:47

question was seen: 12,875 times

last updated: 15 Aug '12, 19:51

p​o​w​e​r​e​d by O​S​Q​A