Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

The original filter only included the etc.src field. Should it also include eth.dst?

(eth.src == 6e:ec:5e:4b:a2:22 and eth.dst == d6:97:f0:86:01:0b) or (eth.dst == 6e:ec:5e:4b:a2:22 and eth.src == d6:97:f0:86:01:0b)

Here is a filter created with Statistics -> Conversations -> Ethernet.
(WSUG: 8.5.1. The “Conversations” Window)

Right click on a conversation and Apply as Filter or Prepare as Filter for the conversation type you're interested in. A <-> B

eth.addr==6e:ec:5e:4b:a2:22 && eth.addr==d6:97:f0:86:01:0b