Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Cisco Unique Identifier in Wireshark?

For the users of WireShark, when doing a packet capture is there a unique identifier where I can look the packet and tell if it came from a cisco device?

I was assuming mac address but not all Cisco start with the same mac. I would like to be able to filter out packets that tx from a cisco device.

Thanks

1 REPLY
Community Member

Re: Cisco Unique Identifier in Wireshark?

Have you tried:

Edit > Preferences > Name Resolution > Check enable MAC name resolution.

This should then show the word "Cisco" in the mac address of all Cisco devices.

Alternatively, I would think you would need to build an expression like:

!(eth.src == 00:1b:8f:37:1a:88) and !(eth.src == 00:1b:8f:37:1a:87)

There is instructions in the help file for using partial macs and / or IPs instead of full IPs and / or macs.

274
Views
4
Helpful
1
Replies
CreatePlease to create content