To know more about filter by IP in Wireshark, please follow below link: My filter above still displays these 0x02 packets.Port filtering is the way of filtering packets based on port number. This type of packet I would like to exclude with the filter. I'd like to have wireshark display both these packets Its only displaying packets where Protocol is LLC but its also letting through packets where the 15th byte is 0x02 which I want to avoidĪny ideas how I can succesfully target the 15th byte value, or to put it another way, the 1st byte value of the payload?Įxample packet (copied from wireshark) where 15th byte is 0x00: 0000 01 01 01 01 01 01 02 02 02 02 02 02 00 0e 00 05. This comes up green so I'm pretty sure the syntax is correct. Here is what I tried: llc & (frame = 00 || frame = 01) at the logical-link control layer so I also filter on LLC as the protocol

The packets I am interested in are raw ethernet, i.e. the 1st payload byte after the 14 byte header) is a specific value, either 0x00 or 0x01. I am trying to filter packets where the 15th byte (i.e.

Wireshark filter http packet