Ask Your Question
0

Wildcard not working in eth.addr

asked 2023-07-06 19:19:54 +0000

muwaha gravatar image

updated 2023-07-07 08:30:41 +0000

grahamb gravatar image

I'm trying to look for a potential duplicate MAC Address. I've read that the . or * is suppose to be the wildcard, but the filter isn't accepting that.

I've tried

eth.addr == 00:04:f2:ae:55:33
eth.addr == 00:04:f2:**:**:**
eth.addr == 00:04:f2:*
eth.addr == 00:04:f2:.
eth.addr == 00:04:f2:..:..:..
eth.addr == 00:04:f2:.:.:.

The filter just remains red and won't accept the filter.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2023-07-08 15:22:36 +0000

cmaynard gravatar image

I'm trying to look for a potential duplicate MAC Address.

You might want to use tshark along with other CLI tools to help with this? For example:

tshark -r file.pcapng -Y "eth.addr[0:3] == 00:04:f2" -T fields -e eth.src -e ip.src > eth_addr.txt
tshark -r file.pcapng -Y "eth.addr[0:3] == 00:04:f2" -T fields -e eth.dst -e ip.dst >> eth_addr.txt
sort eth_addr.txt | uniq -c
edit flag offensive delete link more
0

answered 2023-07-06 20:28:28 +0000

Chuckc gravatar image

WSUG 6.4.4. Slice Operator:

eth.addr[0:3] == 00:04:f2

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-07-06 19:19:54 +0000

Seen: 409 times

Last updated: Jul 08 '23