On Thu, Oct 30, 2003 at 04:12:45PM -0600, Nick J Marques wrote: > We are using Ethreal to sniff for computers with viruses on our LAN by > filtering for ARP Packets. How can I tell Ethereal to EXCLUDE Mac > Addresses we have already logged??
"Exclude" as in "ignore packets from or to those MAC addresses?
If so, then, once you have those addresses, you'd use a capture filter
such as
not ether host XX:XX:XX:XX:XX:XX and not ether host
YY:YY:YY:YY:YY:YY ...
