Establishing a display filter that hides VMWare frames and packets.

asked 2018-08-30 15:30:51 +0000

greenfreq
68 ●1 ●2 ●9

I've been trying to figure out a display filter that will allow me to hide packets from VMWare. I've tried using eth.addr but without success. eth.addr matches "^00:0c:29:" would in my mind check that the first three bytes matched; however, this does not appear to be the case. Any ideas on how to make this work?

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-08-30 16:09:09 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

As mentioned in the wireshark-filter man page, the matches (or ~) operator "is only implemented for protocols and for protocol fields with a text string representation.", of which the Ethernet source and destination MAC addresses are not.

In any case, I think you can use the slice operator to achieve your goal, for example:

eth.addr[0:3] == 00:0c:29

edit flag offensive delete link

Comments

Thank you. the slice suggestion appears to work for my purposes.

greenfreq ( 2018-08-30 16:49:44 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-08-30 15:30:51 +0000

Seen: 336 times

Last updated: Aug 30 '18

Establishing a display filter that hides VMWare frames and packets. edit