Revision history [back]

"ehter host" is a capture filter. To filter the displayed packets use a display filter. For Ethernet address use "eth.addr == xx:xx:xx:xx:xx:xx".

See also: https://gitlab.com/wireshark/wireshark/-/wikis/DisplayFilters and https://www.wireshark.org/docs/man-pages/wireshark-filter.html

Via the menu Statistics / Endpoints you can easily see the MAC addresses present in the file and use the 'apply as filter' in the context menu.

"ehter host" is a capture filter. To filter the displayed packets use a display filter. For Ethernet address use "eth.addr == xx:xx:xx:xx:xx:xx".

See also: https://gitlab.com/wireshark/wireshark/-/wikis/DisplayFilters and https://www.wireshark.org/docs/man-pages/wireshark-filter.html

Via the menu Statistics / Endpoints you can easily see the MAC addresses present in the file and use the 'apply as filter' in the context menu. menu.

"ehter host" is a capture filter. To filter the displayed packets use a display filter. For Ethernet address use "eth.addr == xx:xx:xx:xx:xx:xx".

See also: https://gitlab.com/wireshark/wireshark/-/wikis/DisplayFilters and https://www.wireshark.org/docs/man-pages/wireshark-filter.html

Via the menu Statistics / Endpoints you can easily see the MAC addresses present in the file and use the 'apply as filter' in the context menu.

When using a capture filter in the 'Capture Options' menu, the syntax is: "ehter host xx:xx:xx:xx:xx:xx" (semicolon (colon instead of dot).

"ehter host" is a capture filter. To filter the displayed packets use a display filter. For Ethernet address use "eth.addr == xx:xx:xx:xx:xx:xx".

See also: https://gitlab.com/wireshark/wireshark/-/wikis/DisplayFilters and https://www.wireshark.org/docs/man-pages/wireshark-filter.html

Via the menu Statistics / Endpoints you can easily see the MAC addresses present in the file and use the 'apply as filter' in the context menu.

When using a capture filter in the 'Capture Options' menu, the syntax is: "ehter "ether host xx:xx:xx:xx:xx:xx" (colon instead of dot).