filterout broadcast traffic for metasploit


I have a pcap file and I want to filter out all broadcast traffic such as ARP

What is the syntax I would need to type in the FILTER: box?
Who is Participating?
Rich RumbleSecurity SamuraiCommented:
And if you want to filter them out of the saved version after you apply such a filter, you can go to File->Export Specified Packets -> (select displayed packets) All Packets and save as a new filename.

in the future, you can highlight a broadcast packet, right-click and Apply as Filter ->Not selected and that will filter out things you don't want. You can adjust the filters anytime and change things like ip.src to ip.addr (I do this all the time so I don't need ip.src and ip.dst statements), ip.addr is both src/dst. You can clear the filters anytime too, they can be quite picky so mess with the right-click apply as filter, and when you start to add more layers (additional criteria), use the AND, OR, AND NOT, OR NOT logic statements.
Zephyr ICTCloud ArchitectCommented:
You could try with something like this:

 !(arp or icmp) 

Open in new window

You can add extra things like dns or http ...

!(arp or icmp or dns or http) 

Open in new window

trojan81Author Commented:
Thank you
right clicked the packet < prepared as filter < then added a ! before the filter did the trick
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.