Ask Your Question

Revision history [back]

As mentioned in the wireshark-filter man page, the matches (or ~) operator "is only implemented for protocols and for protocol fields with a text string representation.", of which the Ethernet source and destination MAC addresses are not.

In any case, I think you can use the slice operator to achieve your goal, for example:

eth.addr[0:3] == 00:0c:29