--- Begin Message ---
On 07/05/2020 08:53, Guy Harris via tcpdump-workers wrote:
> "Looks like a valid Ethernet address" is defined as "the first three octets
> appear in Wireshark's file giving manufacturer names for OUIs".
What if the destination address is ff:ff:ff:ff:ff:ff (broadcast) for e.g. ARP
request ?
Or some multicast address ?
--
Francois-Xavier
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
