howdy,
I am newbie with ethereal, true, but capture filters are something I should
be able to figure out. Not so, I'm afraid. All I would like to do is
capture based on a destination mac address. I did not have any luck with
man tcpdump or the archives. In the capture preferences, I've tried
ether src == 00:e0:1e:7e:6b:81
ether src = 00:e0:1e:7e:6b:81
ether src eq 00:e0:1e:7e:6b:81
ether src == 00e01e7e6b81
ether src = 00e01e7e6b81
ether src eq 00e01e7e6b81
ether src 00e01e7e6b81
All of the above with single quotes, double quote, grave quotes, etc, etc,
and many other combinations. What would the correct syntax be? I know its
not the same as the display filter syntax.
I get the "parse error" message, which I know has been a source of many
posts. I would be willing to start or create a sample list of capture
statements, if anybody would be willing to email their filter statements,
something that could be added to the faq, maybe?
tia
Daryle Dianis
Technical Analyst
Yamaha Motor Corp.
6555 Katella Ave.
Cypress, CA 90630
714 761-7865
daryle_dianis@xxxxxxxxxxxxxxxx
