This is our old Q&A Site. Please post any new questions and answers at

Troubleshooting an arp issue. Need to capture just a specific mac to see if and when it's requesting arp. Need to see both TX/RX frames.

Looking for assistance with building the tshark filter

Thanks in advance

asked 30 Jul '15, 06:23

cfrass66's gravatar image

accept rate: 0%

eth.addr == "MAC address"


eth.addr == fe:ff:20:00:01:00

permanent link

answered 30 Jul '15, 06:42

Amato_C's gravatar image

accept rate: 14%

If the answer provided solve your problem, could you accept the solution as answered (check mark below the thumbs-up and thumbs-down). This will help others in the future.

Thank you.

(30 Jul '15, 07:03) Amato_C

tshark -i eth4 eth.addr == fe:ff:20:00:01:00 Running as user "root" and group "root". This could be dangerous. Capturing on eth4 tshark: Invalid capture filter: "eth.addr == fe:ff:20:00:01:00"!

This is what i get when attempting that filter? Is there an option that needs to be set ?

(30 Jul '15, 14:33) cfrass66


tshark -i eth4 -f ether host fe:ff:20:00:01:00

(30 Jul '15, 15:17) Amato_C

The reason for the error was that the original form is in display filter syntax.

The second form is in capture filter syntax, which is the default syntax if not prefixed with a flag on the tshark command line.

(30 Jul '15, 15:47) grahamb ♦

Thank you guys!

tshark -i eth4 -f "ether host 08:81:f4:eb:81:4a"

(31 Jul '15, 15:42) cfrass66

Your "answer" has been converted to a comment as that's how this site works. Please read the FAQ for more information.

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(01 Aug '15, 01:16) grahamb ♦
showing 5 of 6 show 1 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Jul '15, 06:23

question was seen: 14,273 times

last updated: 01 Aug '15, 01:16

p​o​w​e​r​e​d by O​S​Q​A