The display filter can be changed above the packet list as can be seen in this picture:Ĭapture only traffic to or from IP address 172.18.5.4: host 172.18.5.4Ĭapture traffic to or from a range of IP addresses: net 192.168.0.0/24Ĭapture traffic from a range of IP addresses: src net 192.168.0.0/24 In the main window, one can find the capture filter just above the interfaces list and in the interfaces dialog.

Display filters on the other hand do not have this limitation and you can change them on the fly.

The latter are used to hide some packets from the packet list.Ĭapture filters are set before starting a packet capture and cannot be modified during the capture. The former are much more limited and are used to reduce the size of a raw packet capture. Like the MAC address, The LLC logical link control protocol is also layer 2, but is upper sublayer of Data Link Layer and won't affect the ability to capture the traffic unless you specify llc as a filter and there isn't any llc traffic, then you would get the blank screen.Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port = 80). (I'm assuming the traffic you are looking for is traveling to a destination on another switch, outside the network, or at least to your gateway).īy specifying the MAC address filter, eth.addr eq xx:xx:xx:xx:xx:xx you are filtering for all traffic to and from that associated MAC address. If you are trying to trace MAC's on the switch you are also connected to, then you'll want to sniff from a port which is spanned/mirrored to the port which has inbound/outbound traffic of that switch, so that you will see all the traffic coming in and out of the switch. For instance, tshark -i 1 -R 'eth.addr eq xx:xx:xx:xx:xx:xx or eth.addr eq xx:xx:xx:xx:xx:xx' You can use a list for your MAC's in one display filter, but not a range, unless you switch to IP's instead of MAC's.

If you are using a display filter of eth.addr = xx:xx:xx:xx:xx:xx and you are not seeing any information being displayed/sniffed, then the traffic for that MAC address is not passing through the port you're sniffing on.

Wireshark mac address filter example