Diagnose sniffer packet MAC addresses

[mhucm]

Any reason why displaying MAC addresses has not been implemented yet?

[darwin_FTNT]

Using v5.6.5,build1600, in cli:

FW60EXXXXXXXXXXX # diagnose sniffer packet wifi 'ether[0:2] == 0xffff' 6 100 interfaces=[wifi] filters=[ether[0:2] == 0xffff] pcap_lookupnet: wifi: no IPv4 address assigned 1.610771 wifi -- arp who-has 192.168.1.254 tell 192.168.1.108 0x0000 ffff ffff ffff 4c11 bff4 04e0 0806 0001 ......L......... ............

[sw2090]

you could also save your capture into a textile (putty could e.g. do that) and convert it to pcap with some script you could find on the net and then open it in Wireshark to see mac addresses.

[ede_pfau]

Not a direct answer but maybe useful: to be able to filter on MACs you need to specify the 'ether' keyword. As already posted, where a part of the string is compared.

[boneyard]

for a broadcast the MAC address in the diagnose sniffer packet with 6 works for both source and destination

but for other MAC address the destination is often 00:00:00:00:00:00 or 00:00:00:00:00:01 which makes little sense, why won't the actual MAC on the wire be shown? this can be useful to detect certain odd network situations.

2019-05-09 03:25:17.926691 wan1 in arp reply 23.1.4.88 is-at 60:4f:cd:c8:5a:80 0x0000   0000 0000 0001 608f cde8 5a80 0806 0001        ......p...Z.....

 [EDIT] ah i now notice this only happens with diagnose sniffer any with sniffer on an interface i do see the actual MAC address.