Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I capture traffic through my wireless card, I get a ton of different kinds of packets showing up. I'd only like to see traffic that is destined for the internet, i.e., no network stuff that is local. If I use Wireshark as a capture filter for 'no multicast and broadcast' then will all the packets I see only be those that are destined for the internet? Thanks.

share|improve this question
I think you meant not (multicast or broadcast)? – grawity Apr 1 '11 at 4:45

No. "Multicast" is a special set of addresses (224/4). "Broadcast" is a special address within a network ("all ones", e.g. the broadcast address for 192.168/16 is You will need to make sure that one of the addresses in the packet is not of the local network.

share|improve this answer
So what filter setting do i need to only see internet destined or internet sourced packets? – baobeiii Dec 27 '10 at 4:26
The one that makes sure that one of the addresses in the packet is not of the local network. – Ignacio Vazquez-Abrams Dec 27 '10 at 4:30

Since traffic bound for the internet will need to go through a router of some sort to get there, the IP packets will be given the MAC address of the router as the destination. You can filter for all packets with the router's MAC address (e.g. eth.dst == 00:0f:66:03:50:a7) as the destination.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .