From d594743e4bad60608166c0247c1c7917dfb58ce6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Valverde?= Date: Wed, 13 Jul 2022 15:28:32 +0100 Subject: [PATCH] dfilter: Fix "private_ethernet" macro The macro expression is invalid because of the range used and looks a bit wrong. Use a simpler expression that should match the intended meaning, filtering for unicast addresses with the U/L bit equal to 1. --- resources/share/wireshark/dfilter_macros | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/share/wireshark/dfilter_macros b/resources/share/wireshark/dfilter_macros index 4f0eae07f7..a85f9134f0 100644 --- a/resources/share/wireshark/dfilter_macros +++ b/resources/share/wireshark/dfilter_macros @@ -2,5 +2,5 @@ # This file is the macro file shipped with Wireshark. # For your personal macros, use the same file in your profile dir. "private_ipv4","$1 == 192.168.0.0/16 or $1 == 172.16.0.0/12 or $1 == 10.0.0.0/8" -"private_ethernet","($1[0-0] & 02) == 0x02 or ($1[0-0] & 06) or ($1[0-0] & 0A) or ($1[0-0] & 06)" +"private_ethernet","$1[0] & 0x0F == 2" "private_ipv6", "ipv6 && $1 == fc00::/7"