This is our old Q&A Site. Please post any new questions and answers at

Hi Big Time NEWBIE, just want to know the simple filter term for finding MAC addresses. Can someone please quickly tell me the right filter command string to display MAC only.

Also if the command can be written in a way to not show my own MAC address.



asked 15 Jan '12, 01:31

morpheyous's gravatar image

accept rate: 0%

What do you mean by "display MAC only"?

(15 Jan '12, 19:38) Guy Harris ♦♦

just want to apply a filter that display's only Mac addresses only. Dont know how to write the filter as I am a noob

Ta Pete

(16 Jan '12, 01:37) morpheyous

By "displays only MAC addresses" do you mean that you want to display only packets going to or from particular MAC addresses (but still display all the columns for those packets and, when you select a packet, display all the details of the packet)?

(16 Jan '12, 10:49) Guy Harris ♦♦

remember not to type the qoutes

source mac filter: "ether.src == macaddress"

destination mac filter: "ether.dst == macaddress"

either mac filter: "ether.addr == macaddress"

to exclude a mac address just put a ! in front of your syntax

permanent link

answered 15 Jan '12, 04:12

thetechfirm's gravatar image

accept rate: 0%

edited 16 Jan '12, 03:37

thetechfirm, thanks so much for replying, as mentioned I am a newbie, i tried placing your exact words in the filter box but got errors. Can u please advise of the exact terms to be put in the filter box, perhaps u can surround with "" for ease.



(15 Jan '12, 19:29) morpheyous

just edited my response for clarity. I assumed you wanted a display or post capture filter. capture filter syntax would be "ether host macaddress" (without the qoutes)

(16 Jan '12, 03:39) thetechfirm

look I am really sorry, but I get 'not a valid protocol error'

(16 Jan '12, 06:38) morpheyous

Hmmm... I just whipped this video up to illustrate. Let me know if it helps.

(16 Jan '12, 09:16) thetechfirm

Hi Tony, thanks heaps for the video, any chance we can chat on Skype - my user is 'callnplay'



(17 Jan '12, 01:05) morpheyous

I can chat tonight anytime after 6 pm EST. my skype id is thetechfirm

(17 Jan '12, 03:13) thetechfirm

Sorry Pete, got my days all mixed up. Got an install scheduled for tonight. Maybe some other time.

(17 Jan '12, 06:03) thetechfirm
showing 5 of 7 show 2 more comments

You can go to Statistics | Conversations.
Click on the tab Ethernet to get an overview of all the MAC addresses in the capture file.
Another option is to go to Statistics | Endpoints to open the "Enpoints"window.

You can learn more about display filters in the Wireshark User's Guide or in the Wireshark Wiki.

permanent link

answered 16 Jan '12, 07:38

joke's gravatar image

accept rate: 9%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Jan '12, 01:31

question was seen: 108,428 times

last updated: 17 Jan '12, 06:03

p​o​w​e​r​e​d by O​S​Q​A