Wireshark-users: [Wireshark-users] Capture filter for MAC addresses
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Frank Bulk" <frnkblk@xxxxxxxxx>
Date: Fri, 25 Jan 2008 18:24:52 -0600
I've looked at the wiki page (http://wiki.wireshark.org/Ethernet) but it's
not entirely clear to me how I would capture the traffic from all those
devices that share the same OUI.

For example, if the OUI of interest was Cisco (00:1b:0d), I have tried this:
	ether[0:4]=0x001B0D
but it didn't seem to work.  I suspect I don't full understand the usage of
the square brackets, and perhaps I need to use a mask of some kind.

Any suggestions?  

Frank