This is our old Q&A Site. Please post any new questions and answers at

Hi all.

I am running tcpdump on DD-WRT routers in order to capture uplink data from mobile phones. I would like to listen only to some mac addresses. To do this I tried to run the command using a syntax similar to Wireshark:

tcpdump -i prism0 ether src[0:3] 5c:95:ae -s0 -w | nc 31337

so that I can listen to all the devices that have as initial mac address 5c:95:ae.

The problem is that the syntax is wrong and I was wondering if anyone of you knows the right syntax to get what I want.

Thanks in advance for the help!!!

Looking forward to hearing from you, Giovanni

asked 26 Oct '12, 05:14

Giovanni%20Soldi's gravatar image

Giovanni Soldi
accept rate: 0%

Yes, somebody knows - the person named "graphite" does. And, no, you do not need "src" in the filter he/she lists - see my followup comment to your comment.

permanent link

answered 26 Oct '12, 18:19

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Oct '12, 05:14

question was seen: 14,192 times

last updated: 26 Oct '12, 18:19

p​o​w​e​r​e​d by O​S​Q​A