In this lecture we are going to capture traffic by Mac address.
So if you want to capture traffic that a particular Mac address sends and receives, then we have the
eater host filter for that.
So let me quickly go to the capture options and select the network interface in the capture filter box
type ITR host.
Now we have to specify a mac address here, so I am quickly going to grab my own MAC address, IP config
slash all.
Let me copy and paste the MAC address here.
Now this filter is only going to capture the traffic or frames that this specified Mac address sends
and receives.
Right.
Wireshark will ignore all other frames and only save or capture the frames that this Mac address sends
or receives.
So let me click on Start Button.
Now I am quickly going to add destination and source Mac address fills into the columns.
So right click on destination, click on Apply S column.
I'm going to repeat the same thing for source right click apply as column.
As you can see, guys, both the fields have been added.
Right now you are going to see this specified Mac address either under the source or destination MAC
address column.
Okay.
As you can see now back to the capture options.
Now, next thing that I'm going to do is narrow down the either host filter to source and destination.
So if you only want to capture the frames that a mac address sends out, then type eater source, this
filter is only going to capture the frames that this Mac address sends out.
So let me hit the start button.
Now under the source column.
As you can see, it is only capturing the frames that the specified Mac address is sending out in the
same way we can, you know, capture the frames that get delivered to a mac address.
All you have to do replace source with the SD.
SD means destination.
Now this filter is only going to capture the frames that this Mac address receives.
So click on Start Now.
This time under the destination column, you are only going to see the specified Mac address, right?
So it is only capturing the frames or traffic that the specified Mac address is receiving.
You can combine multiple MAC addresses with the help of our operators.
So if you type or now specify another MAC address like this, right, you can specify as many MAC addresses
as you like.
Now this filter is only going to capture the frames that both the specified MAC addresses send and receive.
And if you specify a note at the beginning, here I am basically telling Wireshark that do not capture
the frames that this Mac address sends out and receive.