Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Maybe surprisingly there's no indicator in a captured packet if it egressed or ingressed an interface (for most types of interfaces). However, other characteristics of an interface may be used to make that distinction. A very common one is the use of the IPv4 address of the packets: if it's the hosts source address used as source address, the packet is egressing.

This would be the display filter expression: ip.src == <IPv4 host>

This would be the capture filter expression: ip src host <IPv4 host>

Another parameter you can use if the MAC address of the interface.