local mac address capture filter?
I have devices appearing on my network with local mac addresses, they don't hang around very long. Is there a way to capture filter for local mac address (local bit set).
PCAP-FILTER (capture filter syntax) has an example showing destination address and multicast:
To access data inside the packet, use the following syntax: proto [ expr : size ]
For example, `ether[0] & 1 != 0' catches all multicast traffic
The source address is after the destination (bytes 6-11) and the lg bit is 0x02.
ether[6] & 2 != 0

Asked: 2022-05-26 14:39:57 +0000
Seen: 709 times
Last updated: May 26 '22