Wireshark-users: Re: [Wireshark-users] tshark filter by mac address
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: j.snelders@xxxxxxxxxx
Date: Tue, 24 Mar 2009 06:13:37 +0100
Hi Chris,

You can use a capture filter:
-f "not ether host ff:ff:ff:ff:ff:ff and not ether host 00:40:38:6f:76: 
"

Regards
Joan

On Tue, 24 Mar 2009 15:29:15 +1100 Chris wrote:
>
>Is there any way to tell tshark not to show certain mac addresses? I'm
>running: tshark -i eth0 -n port 68 -R 'bootp.type == 2' -o
>column.format:'"Source MAC","%hs"' and want it not to show
>ff:ff:ff:ff:ff:ff and 00:40:38:6f:76
>
>Thanks.
>___________________________________________________________________________
>Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>Archives:    http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe