 | 1 | initial version |
I think the problem here is that you assume that the SLL pseudo header has source and destination addresses like an Ethernet header, which it doesn't. It only has a source, so that's why there is no destination filter. That means that - by the way the capture was taken - you always see the MAC the frame is coming from, but not where it was going to. But for your problem having the source address should be sufficient anyway, as long as you can catch the registration packet.
