 | 1 | initial version |
Maybe surprisingly there's no indicator in a captured packet if it egressed or ingressed an interface (for most types of interfaces). However, other characteristics of an interface may be used to make that distinction. A very common one is the use of the IPv4 address of the packets: if it's the hosts source address used as source address, the packet is egressing.
This would be the display filter expression: ip.src == <IPv4 host>
This would be the capture filter expression: ip src host <IPv4 host>
Another parameter you can use if the MAC address of the interface.
