Establishing a display filter that hides VMWare frames and packets.
I've been trying to figure out a display filter that will allow me to hide packets from VMWare. I've tried using eth.addr but without success. eth.addr matches "^00:0c:29:" would in my mind check that the first three bytes matched; however, this does not appear to be the case. Any ideas on how to make this work?