I've tried a number of things, but none of them seem to do the trick. I want to run this command:
tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len
but to have it ignore any packets from/to one or more devices that have a specific MAC address. I've tried variants of
mac !=, etc with the
If this is not possible with tshark, a separate command (e.g. tcpdump) to preprocess the pcap and filter packets out into a new file would work too. Any tips would be much appreciated!