Ethereal-users: Re: [Ethereal-users] tethereal post capture filtering

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 17 Jul 2005 10:52:41 -0700
M.N.A.Smadi wrote:
i have a large number of libpcap dump files that I want to write a script to filter. I need some help with the following: Q: given a string value for a given field such as the mac address, i can i filter for that? 

	tethereal -R "eth.addr == 00:0a:00:08:02:04" -r {file} -w {output file}
will, for an Ethernet capture, read file {file} and write to file {output file} the packets that have a source or destination address of 00:0a:00:08:02:04. (Note that this will *only* work for Ethernet captures - you'd need to use "tr.addr" for Token Ring, "fddi.addr" for FDDI, "wlan.addr" for 802.11, etc..) 

"-R" takes an arbitrary display filter string (in quotes) as an argument.