This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

filter first 3 hex values of source mac address

0

NEWBIE

the mac address consists out of 6 hex values. But I want to only filter is on the first 3 hex values (brand info)

Is there some kind of wild card I can use, example: ether.src == 00:20:4a:8f:3d:b1

00:20:4a:8f:3d:b1 = Pronet_8f:3d:b1

asked 30 Jan '13, 11:52

mear1628's gravatar image

mear1628
11112
accept rate: 0%


2 Answers:

2

You can use :

eth.src[0:3]==00:20:4a

answered 30 Jan '13, 12:30

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Thanks works like a charm!

(01 Feb '13, 11:25) mear1628

@mear1628

I've converted your "answer" to a comment as that's how this site works, please read the FAQ for details.

If an answer solves your issue please accept it for the benefit of other users by clicking the checkmark icon next to the answer.

(01 Feb '13, 23:59) grahamb ♦

0

You could try this:

eth.src contains 00:20:4a

That will also match your vendor addresses, however also aa:bb:cc:00:20:4a or aa:bb:00:20:4a:xx, however such a false positive seems to be rather unlikely.

Regards
Kurt

answered 30 Jan '13, 11:59

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%