I have few MAC addresses where the OUI portions have been resolved: e.g. Intel_05:04:03.
Is it possible to use tshark to get the actual MAC address for each of my “name resolved” address? E.g. get 02:A0:C9:05:04:03 from Intel_05:04:03?
If this is not possible with tshark, what would would be the easiest way to achieve this on a linux host?
asked 03 Jun '13, 23:52
Using the unresolved and resolved hw address as columns would do the trick, however, it seems that there is a bug that prevents simultaneous diplay of the resolved and unresolved addresses:
I will have a look at why this is...
answered 04 Jun '13, 12:40
You can turn MAC resolution off, edit->preferences->name resolution, untick resolve MAC addresses.
answered 04 Jun '13, 03:29
You can also control whether this resolution happens in the first place with tshark's "-N" option (see the man page for details).
answered 04 Jun '13, 06:21