CODEWITHSUNDEEP
wiresharkethernetpcaptcpdumppacket-capture
Giovanni Soldi
Giovanni Soldi

Reputation: 415

How to filter MAC addresses using tcpdump?

I am running tcpdump on DD-WRT routers in order to capture uplink data from mobile phones. I would like to listen only to some mac addresses. To do this I tried to run the command using a syntax similar to Wireshark:

tcpdump -i prism0 ether src[0:3] 5c:95:ae -s0 -w | nc 192.168.1.147 31337

so that I can listen to all the devices that have as initial mac address 5c:95:ae.

The problem is that the syntax is wrong and I was wondering if anyone of you knows the right syntax to get what I want.

Upvotes: 20

Views: 75670

Answers (1)

graphite
graphite

Reputation: 2958

With man pcap-filter I found this solution:

tcpdump "ether[6:2] == 0x5c95 and ether[8:1] == 0xae"

Upvotes: 13

Related Questions