What does the slice expression eth.src[0:3] == 00:00:83 do in a display filter?

Last Updated :
Discuss
Comments

What does the slice expression eth.src[0:3] == 00:00:83 do in a display filter?

Compares the last 3 bytes of the Ethernet source to 00:00:83

Checks if the Ethernet payload starts with 00:00:83

Compares the first 3 bytes of the Ethernet source address to 00:00:83

Counts how many frames have that source MAC

Share your thoughts in the comments