This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

MAC address Question on the capture file

0

Hello. My professor gave us an homework about wireshark so i am kinda new to this application. I dowloaded the wireshark. My professor sent a .pcap (capture file) to answer the following questions on the homework. So my question is, how do you check the MAC address for the wireless network card in an IP address on the .pcap (captured file) sent by my professor? Thanks

asked 10 Apr '11, 12:36

alvnfer's gravatar image

alvnfer
1●1●1●2
accept rate: 0%

One Answer:

0

I'm not exactly sure what your task actually is (maybe my english isn't good enough to understand it), but I'll try to give you some hints:

If you know the IP address and want to know which MAC address it was used by you can just filter on the ip address using ip.addr==w.x.y.z with w.x.y.z being the IPv4 address. Then you just open the ethernet layer in the decode pane to find everything you might need. Keep in mind that the MAC you'll find might not always be the one the IP is directly associated with, for example if the IP packet was captured coming from a router, but here you said it's coming from a wireless card so you should be fine.

If my answer isn't helping let us know, and maybe try to clarify the question like this:

  1. what do you know about the trace?
  2. what are you supposed to find out?

answered 10 Apr '11, 14:12

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

This is my first time using wireshark so i have low knowlegde of tracing.

I am looking for something like this "6E:51:F5:c1:11:00" which the MAC add on the capture i think.

This is the actual question: What is the MAC address for my wireless network card with an IP address of 879.125.8.3?

I just do not understand what he meant for wireless network card. i cannot trace those

(10 Apr '11, 17:03) alvnfer

Uh, the IP address "879.125.8.3" is not exactly a valid IP, the first octet may not exceed 255. But anyway, if it were a valid IP you'd filter for "ip.src==879.125.8.3" by entering that into the filter bar right on top of the packet list. That will only give you packets comming from your professors IP (which happens to "live" on his wireless card). Look into one of the packets and write down the source MAC address as specified in the ethernet header.

(10 Apr '11, 23:14) Jasper ♦♦