 | 1 | initial version |
PCAP-FILTER (capture filter syntax) has an example showing destination address and multicast:
To access data inside the packet, use the following syntax: proto [ expr : size ]
For example, `ether[0] & 1 != 0' catches all multicast traffic
The source address is 6 bytes after the destination and the lg bit is 0x02.
ether[6] & 2 != 0
| | 2 | No.2 Revision |
PCAP-FILTER (capture filter syntax) has an example showing destination address and multicast:
To access data inside the packet, use the following syntax: proto [ expr : size ]
For example, `ether[0] & 1 != 0' catches all multicast traffic
The source address is 6 bytes after the destination (bytes 6-11) and the lg bit is 0x02.
ether[6] & 2 != 0
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
