This is our old Q&A Site. Please post any new questions and answers at

A column with the type of "Hw src addr (resolved)" and Resolve MAC address name resolution on, I am getting a hostname on instead of a vendor_xx:xx:xx for certain devices. Not all but some. Is there somewhere that has cached this info and is "helping me" here? I wouldn't think this would ever be the correct info in that column for that type of data.

Edit: Ver 2.2.0

asked 12 Sep '16, 08:02

itsme0k's gravatar image

accept rate: 0%

edited 12 Sep '16, 08:52

What version of Wireshark are you using? I experienced this long ago but I think it's since been fixed, although I can't say for sure when. See bug 6534.

(12 Sep '16, 08:34) cmaynard ♦♦

This is 'a stacked' name resolution result, as the MAC address gets resolved to IP address (for IP packets only, obviously), then get resolved to host name. A case could be made this 'stacked name resolution' shouldn't be applied for this column type. It takes some investigation to see if that's possible in current architecture. An enhancement bug could be filed for this.

permanent link

answered 12 Sep '16, 08:20

Jaap's gravatar image

Jaap ♦
accept rate: 14%

If it shouldn't apply to the column, why should it happen anywhere else - why not just remove the whole feature of using ARP packets to add entries to the MAC-address-to-name resolution table?

(13 Sep '16, 19:15) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 12 Sep '16, 08:02

question was seen: 1,318 times

last updated: 13 Sep '16, 19:15

p​o​w​e​r​e​d by O​S​Q​A