For instance, tshark -i 1 -R "eth.addr eq xx:xx:xx:xx:xx:xx or eth.addr eq xx:xx:xx:xx:xx:xx" You can use a list for your MAC's in one display filter, but not a range, unless you switch to IP's instead of MAC's. If you are using a display filter of eth.addr = xx:xx:xx:xx:xx:xx and you are not seeing any information being displayed/sniffed, then the traffic for that MAC address is not passing through the port you're sniffing on.
0 Comments
Leave a Reply. |