This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can I manually resolve IP addresses?

0

Here in front of m,e I have a reference IMS paper with many IP addresses. In the .pcap file, a few IP addresses were manually resolved so a trace is a little more "likeable". I saved this trace file as a new one, and then opened this newly created file. At first it was ok -IP addresses were still displayed with names (words) -but now, when this new file was opened again, there are IP addresses again.

What can I do so IP addresses will always be displayed with words?

asked 29 Apr '11, 18:09

wired's gravatar image

wired
44●13●14●17
accept rate: 9%

edited 23 Feb '12, 17:17

multipleinterfaces's gravatar image

multipleinte...
1.3k●15●23●40

Well, now it works again...strange. :-s

(29 Apr '11, 18:31) wired

One Answer:

2

This all depends on how the name resolution engine is fed with information. It can have several sources:

  • DNS
  • Host file name
  • Manual entries

The only permanent way is to setup a hosts file with the capture.

answered 30 Apr '11, 02:13

Jaap's gravatar image

Jaap ♦
11.7k●16●101
accept rate: 14%

Update: according to http://ask.wireshark.org/questions/9173/can-i-save-manual-address-resolutions the current development version (1.7.x) does allow you to save such name resolutions into a PCAP-NG file.

(24 Feb '12, 06:36) JeffMorriss ♦