Under Ubuntu 14.04, MAC manufacturer resolution (e.g. mapping 00:09:5b:01:02:03 → Netgear_01:02:03) works fine when using the version from the repositories.
However, I wanted to use the latest wireshark version so installed from source. Configure options are:
But following installation, MAC resolution does not work despite being enabled. Build is fine and presents in both Wireshark (QT5, GTK3 build) and TShark.
This is true for both normal MAC fields (e.g. wlan.sa) as well as those with the new "_resolved" extension (wlan.sa_resolved). My manuf file (as provided from the wireshark website) is located in /etc/. The problem still persists even if I try alternative locations including /usr/share/wireshark/, /usr/local/share/wirshsark/ or ~/.wireshark/.
asked 07 Aug '14, 17:50
edited 10 Aug '14, 16:07
Guy Harris ♦♦
Open the Wireshark Help dialog and look in the "Folders" tab for the locations of the "Personal Configuration" and "Global Configuration" folders. The file "manuf" should be in one of those locations to work.
answered 08 Aug '14, 02:54