This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display MAC address in the packet list

0

I am using the filter "bootp.option.type==1 and bootp.option.value==01" to find the DHCP Discovers. When I export the results to a csv file, I get IP addresses all-zeros (No IP yet) and all-ones (broadcast) To know what station is doing this, I need the MAC address of the sender. How can I define the fields that are displayed in the packet list view to include MAC addresses?

asked 12 Nov '12, 07:25

Han%20Koster's gravatar image

Han Koster
0111
accept rate: 0%


2 Answers:

1

You can add a column containing the MAC address you want by selecting it in the decode pane and using the popup menu to "Apply as Column". That way you'll get a new column containing the MAC address, which will be exported in the .csv as well.

Alternatively you can use the Preferences dialog to configure your columns, but it is usually faster to do it from the decode.

answered 12 Nov '12, 07:31

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks, The option "Apply as Column" is not available on my Kubuntu version of Wireshark 1.2.7 But via the Preferences dialog I could do it.

(12 Nov '12, 07:49) Han Koster

Correct, the "Apply as Column" option is a feature of v1.6.x IIRC..

(12 Nov '12, 07:52) Jasper ♦♦

0

Add a column of type "Hardware src addr" to get the source MAC address.

answered 12 Nov '12, 11:38

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%