This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi

I have a problem with the name resolution in wireshark 1.6.2 on ubuntu. I want to display both the IP and , when possible, the resolved ip in two separate columns. I added both the Src addr (resolved) and Src adr (unresolved). The problem is that both column always show the same value. Either the resolved value or the IP depending on name resolution settings.I have the same behaviour in tshark.

my column format column.format: "No.", "%m",
"Time", "%t",
"Src unres", "%us",
"Source", "%rs",
"Source port", "%uS",
"Destination", "%rd",
"Destination", "%ud",
"Dst port", "%uD",
"Protocol", "%p",
"Length", "%L",
"Info", "%i"

Column config
http://imm.io/n9Wz

Display
http://imm.io/n9X0

Tshark
http://pastebin.com/p8jGm0Ts

asked 24 Apr '12, 21:40

Dirum's gravatar image

Dirum
1111
accept rate: 0%


I don't know what's wrong, but it sounds like a bug to me. I'd suggest opening a bug report about it.

permanent link

answered 27 Apr '12, 08:05

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×40
×39
×20

question asked: 24 Apr '12, 21:40

question was seen: 4,755 times

last updated: 27 Apr '12, 08:05

p​o​w​e​r​e​d by O​S​Q​A