Which field contains your data? There is the string() function to transform a field value to a string. This makes it possible to do a regex on that field. Here is an example:
string(arp.src.hw_mac) ~ ".c:..:9d:77:0f:4b"

(where the . is a wildcard for any character, so any nibble in this case)