This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

In the attached test.pcapng file Ethernet source address of all packets should cyclically change from 0 to 3 in the first byte like that:

  • 00.00.00.00.01

  • 01.00.00.00.01

  • 02.00.00.00.01

  • 03.00.00.00.01

  • 00.00.00.00.01

  • 01.00.00.00.01

  • .....

I see these addresses properly in my program, but Wireshark shows them incorrectly:

  • 00.00.00.00.01

  • 00.00.00.00.01

  • 02.00.00.00.01

  • 03.00.00.00.01

  • 00.00.00.00.01

  • 00.00.00.00.01

  • .....

and also for reason I don't understand why it specifically displays the "NETBIOS-" word for the packets with 03.00.00.00.01 address and not for others. I think that either it should not display this word (preferably) or should display it for all packets in the same way.

asked 05 Sep '14, 11:33

Ravil's gravatar image

Ravil
1224
accept rate: 0%

edited 11 Sep '14, 11:40

With which version of Wireshark does this happen? The MAC addresses look OK when I read it with a version built recently from the trunk and with 1.12.0.

(05 Sep '14, 12:45) Guy Harris ♦♦

I see it on both 1.12.0 and 1.10.9. MAC address name resolution has to be on to see the error, otherwise the MAC address displays correctly.

(05 Sep '14, 14:31) Jim Aragon

This is probably another side effect of bug https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10344 that is fixed in the upcoming 1.12.1 and 1.10.10 releases.

(05 Sep '14, 15:59) Pascal Quantin

Let's take the second problem first.

and also for reason I don't understand why it specifically displays the "NETBIOS-" word for the packets with 03.00.00.00.01 address and not for others. I think that either it should not display this word (preferably) or should display it for all packets in the same way.

Click on "View" > "Name Resolution" and then uncheck "Enable for MAC Layer" if you don't want to see that. No, it should not display it for all packets. Wireshark is attempting to display the friendly name for the OUI (Organizational Unit Identifier), which is the first three bytes of the MAC address. Since the first three bytes are different, Wireshark should not display the same thing for all packets.

I suggest opening the manuf file, which is in the Wireshark program files directory, searching for "NETBIOS-" (which you will find down on line 24,869) and read the note immediately above.

And now for the first problem:

I see these addresses properly in my program, but Wireshark shows them incorrectly.

You seem to have encountered a Wireshark display bug. If you turn off MAC address name resolution, as I suggest above, it will also fix this problem.

permanent link

answered 05 Sep '14, 12:23

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Yes, exactly! The problem is solved. Thank you!

(05 Sep '14, 12:34) Ravil
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×34

question asked: 05 Sep '14, 11:33

question was seen: 1,270 times

last updated: 11 Sep '14, 11:40

p​o​w​e​r​e​d by O​S​Q​A