OSQA is unmaintained. Help us figure out where to go from here.

when i write in the filter i get an error, this is what i write: "ether host 'macaddress'". I want to filter it so it only displays packets from the host Mac-address. And when i starts to write 'ether' it doesn't come up white anything i can use. How can a make it capture the MAC address.

asked 19 Sep '12, 00:20

Munken's gravatar image

Munken
16113
accept rate: 100%


eth.src==MACaddress

permanent link

answered 19 Sep '12, 00:29

Munken's gravatar image

Munken
16113
accept rate: 100%

1

This is a display filter for a MAC address. The other syntax "ether host MAC" is a capture filter.

(19 Sep '12, 01:22) Jasper ♦♦

This filter can not apply on my Wireshark 1.12.5 but

ether src  00:08:15:00:08:15

Display as green for Wireshark

permanent link
This answer is marked "community wiki".

answered 31 May '15, 19:37

Sky%20Rover's gravatar image

Sky Rover
61
accept rate: 0%

eg.

!(ether src xx:xx:xx:xx:xx:xx) && !(ether dst xx:xx:xx:xx:xx:xx)

works on Wireshark 2.2.2 as a display filter to see everything except for your own traffic

Regards A3an

permanent link
This answer is marked "community wiki".

answered 24 Nov '16, 03:38

A3an's gravatar image

A3an
62
accept rate: 0%

edited 24 Nov '16, 03:40

To capture packets from MAC address XX:XX:XX:XX:XX:XX:

ether src XX:XX:XX:XX:XX:XX

If you've captured packets without a MAC source address filter, and want to filter the display to show only packets from MAC address XX:XX:XX:XX:XX:XX:

eth.src == XX:XX:XX:XX:XX:XX

if it's an Ethernet capture,

wlan.src = XX:XX:XX:XX:XX:XX

if it's an 802.11 capture, etc..

permanent link

answered 24 Nov '16, 14:54

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335195
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×157
×39

question asked: 19 Sep '12, 00:20

question was seen: 53,996 times

last updated: 24 Nov '16, 14:54

p​o​w​e​r​e​d by O​S​Q​A