Ask Your Question

local mac address capture filter?

asked 2022-05-26 14:39:57 +0000

JamesL gravatar image

I have devices appearing on my network with local mac addresses, they don't hang around very long. Is there a way to capture filter for local mac address (local bit set).

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-05-26 15:34:36 +0000

Chuckc gravatar image

updated 2022-05-26 15:36:54 +0000

PCAP-FILTER (capture filter syntax) has an example showing destination address and multicast:

To access data inside the packet, use the following syntax: proto [ expr : size ]

For example, `ether[0] & 1 != 0' catches all multicast traffic

The source address is after the destination (bytes 6-11) and the lg bit is 0x02.

ether[6] & 2 != 0

image description

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-05-26 14:39:57 +0000

Seen: 386 times

Last updated: May 26 '22