Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?
1
vote
1
answer
819
views
I'm trying to filter traffic by
src ether host
to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24
to see OUI's matching aa:bb:cc
...but it doesn't like that.
**Is there a way to match by MAC prefix or mask?**
In case it matters:
This is for Wi-Fi, so technically it's an SA address that you can see if you scroll to the right (tcpdump
puts that in the src ether host
field).
13:12:48.139316 1.0 Mb/s 2412 MHz 11b -41dBm signal -41dBm signal antenna 0 0us BSSID:ff:ff:ff:ff:ff:ff DA:ff:ff:ff:ff:ff:ff SA:aa:bb:cc:84:05:7c Probe Request (emporia) [5.5* 11.0* 1.0* 2.0* 6.0 12.0 24.0 48.0 Mbit]
Asked by KJ7LNW
(525 rep)
Feb 6, 2023, 09:21 PM
Last activity: Feb 6, 2023, 10:20 PM
Last activity: Feb 6, 2023, 10:20 PM