Wireshark: Filter by Multicast in GUI

Question

Using the Wireshark \"Filter\" field in the Wireshark GUI, I would like to filter capture results so that only multicast packets are shown.

I\'ve seen this post but tha

Answer 1

I came across this solution by a process of trial and error.

Since a multicast address begins "1110" (128+64+32+0 = 224), a packet sent to a an IP address beginning 1110 is destined for a multicast address. Therefor, a packet matching the mask 224.0.0.0/4 is destined for a multicast address.

This display filter should therefor filter packets to multicast addresses only:

ip.dst==224.0.0.0/4