Ethereal-users: Re: [Ethereal-users] Display filter for broadcast/multicast ethernet

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: LEGO <luis.ontanon@xxxxxxxxx>
Date: Sun, 10 Apr 2005 03:11:14 +0200
you might want to try 
eth.dst[0:1} == 01 || eth.dst[0:1] == 03 ..
... or ...
eth.dst[0:1} == 01 or eth.dst[0:1] == 03 ..

the '|' operator isn't a logical OR it's a bitwise OR.
"xxx.flags | 0x0F" will be true if any of the four least significative
bits of xxx.flags is set.

`On Apr 10, 2005 1:19 AM, Michael Kopp <michael.kopp@xxxxxxx> wrote:
> Hi,
> I`d like to create a display filter for ethernet packets where the Broadcast
> bit is set (first byte , lowest bit set)
> as a capture filter this is easy done with "ether multicast"
> but as a capture filter it seems not to be possible, am I right
> (Actually I want to have a coloring rule for that, so the capture filter
> doesnt help me in my situation)
> 
> I tried "eth.dst[0:1} == 01 | eth.dst[0:1] == 03 ..." , but to catch all
> valid broadcast combinations , the filter string gets far to long.
> 
> So I just wanted to check if I`m right with my assumption that it is
> currently not possible ?
> 
> Regards
> Michael
> 
> --
> Sparen beginnt mit GMX DSL: http://www.gmx.net/de/go/dsl
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> 


-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan