Wireshark-users: [Wireshark-users] capture filter
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Tom Greaser" <tgreaser@xxxxxxxxxxx>
Date: Fri, 04 May 2007 10:56:39 -0400
Im weak at filters... 

can someone point me in a good direction.. Im trying to find a LAYER 2 
multicast issue
on the network. that ask luck would have it.. pops up at different
times every day..

The only reason i know of this "issue" some of the switches log the
error..
C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET
and Cisco's fix.. find the sender and fix it..

so im trying to track it down.. but .. i get a few different  multicast
souce addresses

How can i set my capture to allow me to put in just part of the
ethernet address ?

i read the wiki and since i have HIGH volumes of data (gig links
running at 15-50 meg)
id like to do more than just the filter  "mulitcast"
i will if i have too..

i know the source mac  always ends in 0007 

Thanks for any help / direction..