Ask Your Question

Revision history [back]

Wireshark Random MAC Address display filter

Hi guys, I'm new here, I'm having a hard time setting up a filter for Wireshark.

I have tried wlan.ta[0] matches "./2" but I can't get it to work. (My best attempts gave me values like 02:XX:XX:XX.XX:XX but not values like C2:XX:XX:XX:XX:XX

What I actually want is something that will give me _ANY_ MAC Address with the following characters in the first octet, in that specific position, which from my googling means its a private MAC address:

XA:XX:XX:XX:XX:XX XE:XX:XX:XX:XX:XX X2:XX:XX:XX:XX:XX X6:XX:XX:XX:XX:XX

X = any given hex value, doesn't matter I swear I searched but people are almost always into specific OUI codes which is far easier to filter