This is our old Q&A Site. Please post any new questions and answers at

when i write in the filter i get an error, this is what i write: "ether host 'macaddress'". I want to filter it so it only displays packets from the host Mac-address. And when i starts to write 'ether' it doesn't come up white anything i can use. How can a make it capture the MAC address.

asked 19 Sep '12, 00:20

Munken's gravatar image

accept rate: 100%


permanent link

answered 19 Sep '12, 00:29

Munken's gravatar image

accept rate: 100%


This is a display filter for a MAC address. The other syntax "ether host MAC" is a capture filter.

(19 Sep '12, 01:22) Jasper ♦♦

This filter can not apply on my Wireshark 1.12.5 but

ether src  00:08:15:00:08:15

Display as green for Wireshark

permanent link
This answer is marked "community wiki".

answered 31 May '15, 19:37

Sky%20Rover's gravatar image

Sky Rover
accept rate: 0%


!(ether src xx:xx:xx:xx:xx:xx) && !(ether dst xx:xx:xx:xx:xx:xx)

works on Wireshark 2.2.2 as a display filter to see everything except for your own traffic

Regards A3an

permanent link
This answer is marked "community wiki".

answered 24 Nov '16, 03:38

A3an's gravatar image

accept rate: 0%

edited 24 Nov '16, 03:40

To capture packets from MAC address XX:XX:XX:XX:XX:XX:

ether src XX:XX:XX:XX:XX:XX

If you've captured packets without a MAC source address filter, and want to filter the display to show only packets from MAC address XX:XX:XX:XX:XX:XX:

eth.src == XX:XX:XX:XX:XX:XX

if it's an Ethernet capture,

wlan.src = XX:XX:XX:XX:XX:XX

if it's an 802.11 capture, etc..

permanent link

answered 24 Nov '16, 14:54

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Sep '12, 00:20

question was seen: 136,044 times

last updated: 24 Nov '16, 14:54

p​o​w​e​r​e​d by O​S​Q​A