A column with the type of "Hw src addr (resolved)" and Resolve MAC address name resolution on, I am getting a hostname on instead of a vendor_xx:xx:xx for certain devices. Not all but some. Is there somewhere that has cached this info and is "helping me" here? I wouldn't think this would ever be the correct info in that column for that type of data. Edit: Ver 2.2.0 asked 12 Sep '16, 08:02  itsme0k edited 12 Sep '16, 08:52 |
One Answer:
This is 'a stacked' name resolution result, as the MAC address gets resolved to IP address (for IP packets only, obviously), then get resolved to host name. A case could be made this 'stacked name resolution' shouldn't be applied for this column type. It takes some investigation to see if that's possible in current architecture. An enhancement bug could be filed for this. answered 12 Sep '16, 08:20  Jaap ♦ If it shouldn't apply to the column, why should it happen anywhere else - why not just remove the whole feature of using ARP packets to add entries to the MAC-address-to-name resolution table? (13 Sep '16, 19:15) Guy Harris ♦♦ |
What version of Wireshark are you using? I experienced this long ago but I think it's since been fixed, although I can't say for sure when. See bug 6534.