Cisco Unique Identifier in Wireshark?

[robert.harp]

For the users of WireShark, when doing a packet capture is there a unique identifier where I can look the packet and tell if it came from a cisco device?

I was assuming mac address but not all Cisco start with the same mac. I would like to be able to filter out packets that tx from a cisco device.

Thanks

[greg.washburn]

Have you tried:

Edit > Preferences > Name Resolution > Check enable MAC name resolution.

This should then show the word "Cisco" in the mac address of all Cisco devices.

Alternatively, I would think you would need to build an expression like:

!(eth.src == 00:1b:8f:37:1a:88) and !(eth.src == 00:1b:8f:37:1a:87)

There is instructions in the help file for using partial macs and / or IPs instead of full IPs and / or macs.