This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Under Ubuntu 14.04, MAC manufacturer resolution (e.g. mapping 00:09:5b:01:02:03 → Netgear_01:02:03) works fine when using the version from the repositories.

However, I wanted to use the latest wireshark version so installed from source. Configure options are:

./configure --enable-dumpcap --enable-setcap-install --with-dumpcap-group=wireshark --prefix=/usr --sysconfdir=/etc

But following installation, MAC resolution does not work despite being enabled. Build is fine and presents in both Wireshark (QT5, GTK3 build) and TShark.

This is true for both normal MAC fields (e.g. wlan.sa) as well as those with the new "_resolved" extension (wlan.sa_resolved). My manuf file (as provided from the wireshark website) is located in /etc/. The problem still persists even if I try alternative locations including /usr/share/wireshark/, /usr/local/share/wirshsark/ or ~/.wireshark/.

Any ideas?

asked 07 Aug '14, 17:50

ebafaux's gravatar image

ebafaux
11113
accept rate: 0%

edited 10 Aug '14, 16:07

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

Was using 1.12.0 and noticed Layer 2 captures were no longer showing name resolution either. Removed 1.12.0 and went back to 1.10.9 and everything's fine again. BOO! :-)

(22 Aug '14, 06:19) obgmugen

Open the Wireshark Help dialog and look in the "Folders" tab for the locations of the "Personal Configuration" and "Global Configuration" folders. The file "manuf" should be in one of those locations to work.

permanent link

answered 08 Aug '14, 02:54

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I just installed wireshark 1.12.0 on win7 and mac resolution doesn't work anymore, reverted back to 1.10.9 everything is ok. Did not modify the existing manuf that comes with the installation ...

(10 Aug '14, 07:38) mrEEde

I can confirm that for Version 1.12.0-rc2-125-g8a47b3a

(10 Aug '14, 07:59) Kurt Knochner ♦
2
(10 Aug '14, 08:11) Bill Meier ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×157
×58
×20
×4

question asked: 07 Aug '14, 17:50

question was seen: 2,462 times

last updated: 22 Aug '14, 06:59

p​o​w​e​r​e​d by O​S​Q​A