LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   How to get all the mac address from captured package? (https://www.linuxquestions.org/questions/linux-networking-3/how-to-get-all-the-mac-address-from-captured-package-4175581842/)

luofeiyu 06-09-2016 05:29 AM

How to get all the mac address from captured package?
 
tcpdump -i any -w all.cap
Now how to get get all the mac address from captured package?
Same mac address as one address.

Turbocapitalist 06-09-2016 06:04 AM

The -e option in "tcpdump" will print the link-level header when reading the pcap file.

You'll want to familiarize yourself with the manual page for "tcpdump" or else read the pcap file in with wireshark. If you do the latter, just be sure to run wireshark as a normal user and not root.


All times are GMT -5. The time now is 06:04 AM.