This is a static archive of our old Q&A Site. Please post any new questions and answers at

Lack of MAC resolution in tshark on Raspberry Pi


So from checking here it seems that the current build of tshark that runs on RasPi does not support the wlan.sa_resolved field for MAC name resolution. Is there any way around this? A manual install version that will run on a Raspberry Pi perhaps?

asked 22 Mar '15, 03:05

youcloudsofddom's gravatar image

accept rate: 0%

what is you tshark version on the Pi (tshark -v)?

(23 Mar '15, 09:58) Kurt Knochner ♦

@Kurt Knochner It's 1.8.2

(23 Mar '15, 15:52) youcloudsofddom

2 Answers:


Sounds like the maintainer of the Raspberry Pi package for tshark did not include the manufacturers file (maybe to keep the package small). Perhaps it is enough to copy the "manuf" file from your mac to the Raspberry Pi to the global preferences directory (search for the cfilters, dfilters and colorfilters files if you're not sure which directory contains the global preferences).

answered 24 Mar '15, 13:43

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

manuf is right there, from libwireshark-data, in /usr/share/wireshark/. The problem is that the dissector of his version of tshark doesn't have that field.

(25 Mar '15, 09:30) Jaap ♦

Oops, you're right. I did not bother to check

(25 Mar '15, 12:05) SYN-bit ♦♦


If I check the Raspbian repository I see that they have a package for Wireshark 1.12.1 (including tshark), of which the wireless LAN dissector has this field. What would be needed, with respect to required other packages, I do not know. I may require a more extensive upgrade (to jessie/testing maybe). That is depending on the distribution.

answered 25 Mar '15, 09:33

Jaap's gravatar image

Jaap ♦
accept rate: 14%