Capture Filter for range of MAC addresses

Question

I'm attempting to create a capture filter for a range of MAC addresses.

The range of addresses is: 0009fbx6 where x can be any number

Answer 1

You can create a filter that manually looks at the mac address fields in the ethernet header. Here is what the normal "ether host 11:22:33:44:55:66" looks like in BPF code:

$ tcpdump -d ether host 11:22:33:44:55:66
(000) ld       [8]
(001) jeq      #0x33445566      jt 2    jf 4
(002) ldh      [6]
(003) jeq      #0x1122          jt 8    jf 4
(004) ld       [2]
(005) jeq      #0x33445566      jt 6    jf 9
(006) ldh      [0]
(007) jeq      #0x1122          jt 8    jf 9
(008) ret      #65535
(009) ret      #0
$

So in your case, you want to look at the ethernet destination address, which starts at offset o in the ethernet header and you will need the first 4 octets. This can be done with ether[0:4], then you need to mask all the bits in which you are not interested, this can be done with ether[0:4] & 0xffffff0f. Then compare this with your specific address range 0x0009fb06. The same goes for the ethernet source address which can be found at offset 6. This will result in the filter:

 ether[0:4] & 0xffffff0f = 0x0009fb06 or ether[6:4] & 0xffffff0f = 0x0009fb06

This filter will result in the following BPF code:

$ tcpdump -d "ether[0:4] & 0xffffff0f = 0x0009fb06 or ether[6:4] & 0xffffff0f = 0x0009fb06"
(000) ld       [0]
(001) and      #0xffffff0f
(002) jeq      #0x9fb06         jt 6    jf 3
(003) ld       [6]
(004) and      #0xffffff0f
(005) jeq      #0x9fb06         jt 6    jf 7
(006) ret      #65535
(007) ret      #0
$