Wireshark-users: Re: [Wireshark-users] conditional display filters on Wireshark?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Rogelio <scubacuda@xxxxxxxxx>
Date: Tue, 19 Jul 2011 16:13:17 -0300
Chris Maynard wrote:

Yes, this is possible.  Have a look here:

http://wiki.wireshark.org/DisplayFilters
http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
Thanks, Chris. Your URL was helpful in helping me determine unknown unicast traffic in an L2TPv2 tunnel. 

What I did...
display filter: !(eth.ig == 1) && !(eth.dst == Cisco_11:22:33) (to show unicast traffic that was coming from places other than the Cisco gateway ethernet MAC addr) 

Then I'm drilling down from there to look more closely in that traffic
display filter: !(eth.ig == 1) && !(eth.dst == Cisco_11:22:33) && l2tp && arp (&& other stuff to narrow down this big list)
Once I find an interesting packet, then I see if it ever originated on my segment 

e.g.

display filter: eth.src == Apple_99:88:77
If it doesn't, then I know that the unicast is a problem and that I could very well need some sort of a switch with UUFB (unknown unicast flood blocking).