In last two lectures, we covered how to filter traffic by IP address and put a numbers right.
Now in this lecture, we are going to learn how you can filter traffic by Mac address or addresses.
It is equally important, right?
So in the filter bar type edge, it means Ethernet address.
Mac address is also known as physical address, hardware address or Ethernet address.
So it here is short for the internet address.
So it h dot a double D are equal to now type the MAC address.
I'm going to type my own Mac address.
If I hit enter.
As you can see, guys, now, Wireshark is displaying all the packets or frames that this particular
Mac address has sent or received.
And here also, guys, you can use our operator to combine multiple Mac addresses.
E third id are equal to and here you can specify another Mac address.
Now this time a Wireshark is going to display frames or packets that these two specified Mac addresses
have sent or received.
And you can also use note operator here, just like we used with IP header filter node.
Now Wireshark has removed all the packets that this particular Mac address has sent or received.
Now let's say you only want to see the packets or frames that a particular Mac address has sent out.
Then replace Adder with source OC.
It is going to display all the frames that this particular Mac address has sent.
Now, before pressing enter, I'm going to add the source Mac field into the columns.
It will make it easier to analyze the MAC addresses.
So either source right click on source field, click on Apply S column.
As you can see, a new source Mac address field has been added into the columns.
Right.
I'm going to drag and drop the Mac address field at the end.
I'm also going to add the destination field, right click on destination, click on Apply Column.
As you can see, Destination Mac Address Field has also been added.
Let me drag it at the end.
Now we have both source and destination.
Now if I apply this filter by hitting enter now guys you are only going to see this Mac address in the
source field.
As you can see, it is only displaying the packets or frames that this specified Mac address has sent
and if you replace source with destination now, it is only going to display the packets that this Mac
address has received.
So if I hit Enter now under the destination column, you are only going to see this Mac address as you
can see.