Wireshark · Wireshark-users: Re: [Wireshark-users] capture filter

[Guy Harris <guy@xxxxxxxxxxxx>]

Tom Greaser wrote:

> How can i set my capture to allow me to put in just part of the
> ethernet address ?
>
> i read the wiki and since i have HIGH volumes of data (gig links
> running at 15-50 meg)
> id like to do more than just the filter  "mulitcast"
> i will if i have too..
>
> i know the source mac  always ends in 0007 

A capture filter of

	ether[10:2] == 0x0007

will check bytes 10 and 11 (the first byte being 0) of the packet 
against 00:07; that checks the last 2 bytes of the source MAC address.

See the tcpdump/WinDump man page for capture filter details; look for 
"expression" to find the description of filters, and look for "expr 
relop expr" for a description of the syntax of general comparisons such 
as that.