This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to see IP to MAC mapping from a trace

0	Hi, this is my first post here. I have a trace I'm analyzing, and I need to extract a list of all ip addresses with the corresponding mac addresses. Or the other way around, either way is fine. Thank you, Michael ip mac mapping to asked 29 Nov '13, 16:26 MichaelSB 16●1●1●4 accept rate: 0%

One Answer:

You might want to use tshark, rather than wireshark, for this purpose. Assuming Ethernet encapsulation, you could try extracting each source MAC/IP address pair and each destination MAC/IP address pair using something along the lines of:

tshark -r infile.pcap -T fields -e eth.src -e ip.src -e eth.dst -e ip.dst > tmp.txt sort -u tmp.txt > mac_ip.txt

answered 29 Nov '13, 20:42

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Thanks! Just what I needed. I wonder why this is not available in Wireshark GUI.

(29 Nov '13, 22:07) MichaelSB