Wireshark-users: Re: [Wireshark-users] Basic question about Wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andreas <AndreasSander1@xxxxxxx>
Date: Mon, 25 Jul 2011 21:43:48 +0200
Am 24.07.2011 19:39, schrieb Frank Walter:

OK, this is clear now. Thank you!

Now I used my MacBook laptop to do wireless sniffing in monitor mode with Wireshark 1.6.1.
I see many, many packets with Destination "Broadcast" (ff:ff:ff:ff:ff:ff).
When I try to set a filter that all those Broadcast-packets are omitted, it ends only in an empty list.
I tried:

eth.dst != ff:ff:ff:ff:ff:ff

but also with eth.dst == ff:ff:ff:ff:ff:ff

the result is empty. I don't know how to call the Destination, the context-menu "Apply as filter / Selected" gives me the wrong name (eth.dst).

What is it?


Both display filters
  eth.dst != ff:ff:ff:ff:ff:ff
  eth.dst!=ff:ff:ff:ff:ff:ff
work for me (Wireshark 1.6.0). Are you sure you have broadcast and not-broadcast packets. 

Anyway you should use
  !(eth==ff:ff:ff:ff:ff:ff)
to exclude broadcast.