How to filter MAC addresses using tcpdump?
ethernet, packet-capture, pcap, tcpdump, wireshark
Solution
With `man pcap-filter` I found this solution:
tcpdump "ether[6:2] == 0x5c95 and ether[8:1] == 0xae"
Problem
I am running tcpdump on DD-WRT routers in order to capture uplink data from mobile phones. I would like to listen only to some mac addresses. To do this I tried to run the command using a syntax similar to Wireshark: `tcpdump -i prism0 ether src[0:3] 5c:95:ae -s0 -w | nc 192.168.1.147 31337` so that I can listen to all the devices that have as initial mac address `5c:95:ae`. The problem is that the syntax is wrong and I was wondering if anyone of you knows the right syntax to get what I want.