Wireshark: Filter by Multicast in GUI

Question

Using the Wireshark "Filter" field in the Wireshark GUI, I would like to filter capture results so that only multicast packets are shown.

I've seen this post but that doesn't work for the GUI filter field. This Wireshark page shows how to filter out multicast, but not how to filter everything but multicast.

Does anyone know of a simple statement that will do this?

Thank you in advance!

Bergmann

Answer 1

Just use this (eth.dst[0] & 1) . Multicast traffic is recognized by the least significant bit of the most significant byte of the MAC address. If 1, multicast, if 0, not.

Bluebell

That produces the Wireshark error "multicast" was unexpected in this context. Any ideas? I wonder if there is simply a syntax issue. ip==multicast didn't produce an error, but it doesn't show any resuts either (and there are many many multicast packets that should be showing). – Bergmann

Did you try ip==multicast and ether==multicast? – Bluebell

As mentioned above, ip==multicast didn't produce any results. ether==multicast produces the Wireshark error Neither "ether" nor "multicast" are field or protocol names. – Bergmann

Edited my answer with a more direct solution – Bluebell

This also displays broadcast, see mojjj's answer. – Inexpensive

That is true, but broadcast is a type of multicast traffic. So this still answers the original question. @mojjj's answer is still beneficial because it does provide a way to explicitly exclude broadcast. – Bluebell

Sorry my bad, would like to remove the downvote but can't – Inexpensive

Answer 2

(eth.dst[0]&1) 

will filter both multicast and broadcast. So, from this exclude broadcast. It will be like

(eth.dst[0]&1) && !eth.dst==ff:ff:ff:ff:ff:ff 

Shapiro

What worked for me was eth.dst[0]&1 && eth.dst!=ff:ff:ff:ff:ff:ff – Glinys

Answer 3

I came across this solution by a process of trial and error.

Since a multicast address begins "1110" (128+64+32+0 = 224), a packet sent to a an IP address beginning 1110 is destined for a multicast address. Therefor, a packet matching the mask 224.0.0.0/4 is destined for a multicast address.

This display filter should therefor filter packets to multicast addresses only:

ip.dst==224.0.0.0/4

Extraterrestrial

I think this must be the solution for the network packets with IP layer. Using MAC address information for broadcast is more general solution. – Kentigera

Note that this filter display IPv4 multicast only, hiding IPv6. – Amund

Answer 4

With Wireshark (2.2.6 version for Linux) is possible to choose the filter "eth.ig == 1"

It refer to "IG bit" that is present in the Ethernet Frame.

The IG bit distinguishes whether the MAC address is an individual or group (hence IG) address. In other words, an IG bit of 0 indicates that this is a unicast MAC address, an IG bit of 1 indicates a multicast or broadcast address.

Cesya

Answer 5

Have you tried just using multicast as your filter? Because if not multicast filters out all multicast packets and lets through everything else as the page you linked seems to state, then that's only logical.

Esp

I did try that but Wireshark gives the error "multicast" is neither a field nor a protocol name. – Bergmann

Oh, looks like that's because it's actually a capture filter rather than a display filter. Sorry for not noticing before. – Esp