Wireshark – Filter by MAC Address

Open up your capture file in Wireshark.

And apply the following display filter.  Shortcut key is Ctrl+/

eth.src == aa:bb:cc:dd:ee:ff

Change the above mac address to the one you want to filter by.

Leave a Reply