Examples of filters that use substring operators are as follows:
- Packets to IPv4 multicast addresses
eth.dst[0:3] == 01:00:5e RFC 1112, section 6.4 allocates the MAC address space of 01-00-5E-00-00-00 to 01-00-5E-FF-FF-FF to multicast addresses.
- Packets to IPv6 multicast addresses
eth.dst[0:3] == 33:33:00 RFC 2464, section 7 allocates the MAC address space that starts with 33-33 to multicast addresses.