capture filter MAC

Question

when i write in the filter i get an error, this is what i write: "ether host 'macaddress'". I want to filter it so it only displays packets from the host Mac-address. And when i starts to write 'ether' it doesn't come up white anything i can use. How can a make it capture the MAC address.

Accepted Answer

1	eth.src==MACaddress answered 19 Sep '12, 00:29 Munken 16●1●1●3 accept rate: 100% 1 This is a display filter for a MAC address. The other syntax "ether host MAC" is a capture filter. (19 Sep '12, 01:22) Jasper ♦♦

Answer 2

This filter can not apply on my Wireshark 1.12.5 but

ether src  00:08:15:00:08:15

Display as green for Wireshark

Answer 3

eg.

!(ether src xx:xx:xx:xx:xx:xx) && !(ether dst xx:xx:xx:xx:xx:xx)

works on Wireshark 2.2.2 as a display filter to see everything except for your own traffic

Regards A3an

Answer 4

To capture packets from MAC address XX:XX:XX:XX:XX:XX:

ether src XX:XX:XX:XX:XX:XX

If you've captured packets without a MAC source address filter, and want to filter the display to show only packets from MAC address XX:XX:XX:XX:XX:XX:

eth.src == XX:XX:XX:XX:XX:XX

if it's an Ethernet capture,

wlan.src = XX:XX:XX:XX:XX:XX

if it's an 802.11 capture, etc..