From a given pcap file how to filter mac frames?

Asked Apr 19 '18 at 13:53

Active Apr 19 '18 at 15:19

Viewed 121 times

From a given pcap file how do I filter mac frames and display the result in the terminal window?

So far, I have the following code that iterates through all frames

import pyshark
cap = pyshark.FileCapture('filename.pcap')
for pkt in cap:
    print pkt

I would like to filter out the mac frames.

edited Apr 19 '18 at 15:19

Mr. T

asked Apr 19 '18 at 13:53

muneeb shah

The question is : what do you mean by mac frames ? An IP packet that would come from a device with MacOS operating system ? – sandwood Apr 19 '18 at 14:04
@sandwood Maybe [Ethernet frame](https://en.wikipedia.org/wiki/Ethernet_frame)? "MAC" can mean "Medium Access Control". This is all part of layer 2 in the OSI model. – Andrew Myers Apr 19 '18 at 14:33
I hope he doesn't mean ethernet.. if he does, that would be pretty much everything. :) – David Hoelzer Apr 19 '18 at 17:57

0 Answers0