Networking
Wireshark Filters for Ethernet Multicast and Broadcast
On the Ethernet level, multicast traffic (and broadcast, which is just a special case of multicast) can be recognized by the least significant bit of the most significant byte of the MAC address. If this bit is set to 1, then the Ethernet frame is multicast traffic, otherwise it is unicast.
Display Filter for Excluding Broadcast/Multicast Traffic
!(eth.dst[0] & 1)
A display filter is used for packet filtering while viewing captured traffic.
Capture Filter for Excluding Broadcast/Multicast Traffic
not broadcast and not multicast
Wireshark capture filters are specified before capturing commences, and use the same syntax as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/WinPcap library. Capture filters can exclude traffic from being captured at all.
How about one FOR broadcast and multicast only
George,
try removing the bang !; also keep the parenthesis optional at that point.
_BT