This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am using the filter "bootp.option.type==1 and bootp.option.value==01" to find the DHCP Discovers. When I export the results to a csv file, I get IP addresses all-zeros (No IP yet) and all-ones (broadcast) To know what station is doing this, I need the MAC address of the sender. How can I define the fields that are displayed in the packet list view to include MAC addresses?

asked 12 Nov '12, 07:25

Han%20Koster's gravatar image

Han Koster
0111
accept rate: 0%


You can add a column containing the MAC address you want by selecting it in the decode pane and using the popup menu to "Apply as Column". That way you'll get a new column containing the MAC address, which will be exported in the .csv as well.

Alternatively you can use the Preferences dialog to configure your columns, but it is usually faster to do it from the decode.

permanent link

answered 12 Nov '12, 07:31

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks, The option "Apply as Column" is not available on my Kubuntu version of Wireshark 1.2.7 But via the Preferences dialog I could do it.

(12 Nov '12, 07:49) Han Koster

Correct, the "Apply as Column" option is a feature of v1.6.x IIRC..

(12 Nov '12, 07:52) Jasper ♦♦

Add a column of type "Hardware src addr" to get the source MAC address.

permanent link

answered 12 Nov '12, 11:38

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×44
×40
×7

question asked: 12 Nov '12, 07:25

question was seen: 41,023 times

last updated: 12 Nov '12, 11:38

p​o​w​e​r​e​d by O​S​Q​A