Sample Header Ad - 728x90

Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?

1 vote
1 answer
819 views
I'm trying to filter traffic by src ether host to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24 to see OUI's matching aa:bb:cc...but it doesn't like that. **Is there a way to match by MAC prefix or mask?** In case it matters: This is for Wi-Fi, so technically it's an SA address that you can see if you scroll to the right (tcpdump puts that in the src ether host field).
13:12:48.139316 1.0 Mb/s 2412 MHz 11b -41dBm signal -41dBm signal antenna 0 0us BSSID:ff:ff:ff:ff:ff:ff DA:ff:ff:ff:ff:ff:ff SA:aa:bb:cc:84:05:7c Probe Request (emporia) [5.5* 11.0* 1.0* 2.0* 6.0 12.0 24.0 48.0 Mbit]
Asked by KJ7LNW (525 rep)
Feb 6, 2023, 09:21 PM
Last activity: Feb 6, 2023, 10:20 PM