I am using the filter "bootp.option.type==1 and bootp.option.value==01" to find the DHCP Discovers. When I export the results to a csv file, I get IP addresses all-zeros (No IP yet) and all-ones (broadcast) To know what station is doing this, I need the MAC address of the sender. How can I define the fields that are displayed in the packet list view to include MAC addresses? asked 12 Nov '12, 07:25  Han Koster |
2 Answers:
You can add a column containing the MAC address you want by selecting it in the decode pane and using the popup menu to "Apply as Column". That way you'll get a new column containing the MAC address, which will be exported in the .csv as well. Alternatively you can use the Preferences dialog to configure your columns, but it is usually faster to do it from the decode. answered 12 Nov '12, 07:31  Jasper ♦♦ |
Add a column of type "Hardware src addr" to get the source MAC address. answered 12 Nov '12, 11:38  Guy Harris ♦♦ |
Thanks, The option "Apply as Column" is not available on my Kubuntu version of Wireshark 1.2.7 But via the Preferences dialog I could do it.
Correct, the "Apply as Column" option is a feature of v1.6.x IIRC..