This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

This may be a very trivial question but I can't figure it out by myself. Examining a packet trace of a ping from node1 to node2 I see that in the echo/reply packets the destination MAC is not present under "Linux cooked capture" section on Wireshark.

The capture was obtained with tcpdump on Ubuntu.

Why the destination MAC address is not there?, how node2 knows that the packets should be received by its network interface if the packet doesn't have a destination MAC address?. The ping works fine but I am struggling with the concept of source and destination MAC when I analyze the trace.

Any help is appreciated.

Juan.

asked 09 Sep '11, 16:00

Juan's gravatar image

Juan
6112
accept rate: 0%

1

On what network device did you capture this? If it's on the "any" device, then see SYNbit's comment; given the way the "any" device works, it captures in a mode where you can't get the destination address. If it's on a particular network device (such as, for example, eth0), if that device is an Ethernet or Wi-Fi device, you should get the source and destination addresses.

(09 Sep '11, 22:59) Guy Harris ♦♦

In fact I was using "any" on tcpdump, after I limited the capture to a particular interface I can see the destination address. Thanks.

(12 Sep '11, 08:33) Juan

permanent link

answered 09 Sep '11, 16:32

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Thanks, that explains my problem.

(12 Sep '11, 08:32) Juan
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×157
×48

question asked: 09 Sep '11, 16:00

question was seen: 10,553 times

last updated: 12 Sep '11, 08:33

p​o​w​e​r​e​d by O​S​Q​A