This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hw src addr (resolved) Column?

0

A column with the type of "Hw src addr (resolved)" and Resolve MAC address name resolution on, I am getting a hostname on instead of a vendor_xx:xx:xx for certain devices. Not all but some. Is there somewhere that has cached this info and is "helping me" here? I wouldn't think this would ever be the correct info in that column for that type of data.

Edit: Ver 2.2.0

asked 12 Sep '16, 08:02

itsme0k's gravatar image

itsme0k
6557
accept rate: 0%

edited 12 Sep '16, 08:52

What version of Wireshark are you using? I experienced this long ago but I think it's since been fixed, although I can't say for sure when. See bug 6534.

(12 Sep '16, 08:34) cmaynard ♦♦

One Answer:

0

This is 'a stacked' name resolution result, as the MAC address gets resolved to IP address (for IP packets only, obviously), then get resolved to host name. A case could be made this 'stacked name resolution' shouldn't be applied for this column type. It takes some investigation to see if that's possible in current architecture. An enhancement bug could be filed for this.

answered 12 Sep '16, 08:20

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

If it shouldn't apply to the column, why should it happen anywhere else - why not just remove the whole feature of using ARP packets to add entries to the MAC-address-to-name resolution table?

(13 Sep '16, 19:15) Guy Harris ♦♦