Wildcard not working in eth.addr

asked 2023-07-06 19:19:54 +0000

muwaha
1 ●2 ●2

updated 2023-07-07 08:30:41 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

I'm trying to look for a potential duplicate MAC Address. I've read that the . or * is suppose to be the wildcard, but the filter isn't accepting that.

I've tried

eth.addr == 00:04:f2:ae:55:33
eth.addr == 00:04:f2:**:**:**
eth.addr == 00:04:f2:*
eth.addr == 00:04:f2:.
eth.addr == 00:04:f2:..:..:..
eth.addr == 00:04:f2:.:.:.

The filter just remains red and won't accept the filter.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2023-07-08 15:22:36 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

I'm trying to look for a potential duplicate MAC Address.

You might want to use tshark along with other CLI tools to help with this? For example:

tshark -r file.pcapng -Y "eth.addr[0:3] == 00:04:f2" -T fields -e eth.src -e ip.src > eth_addr.txt
tshark -r file.pcapng -Y "eth.addr[0:3] == 00:04:f2" -T fields -e eth.dst -e ip.dst >> eth_addr.txt
sort eth_addr.txt | uniq -c