I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:8163 .

What is the display filter expression using the offset and slice operators or a wildcard expression that I would need to use?

I tried to use this one but it didn't work.

ipv6.host matches "\113\:5005\:7b:\091B$"

P.S The destination mac of the packet is actually to a firewall and hence I cannot apply a mac level filter.

1 Answer 1


I found the answer myself. The display filter would be

ipv6.host matches ":113:5005:7b:091b$"
  • Please accept when possible in two days. :-)
    – user36472
    Mar 13, 2019 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.