This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display device name instead of IP

I would like to somehow configure wireshark to display the device name (such as Bobs.iPhone or Bob.iMac) rather than the local IP (such as 192.168.1.172) — I've already configured Wireshark to resolve external IPs, but can't figure out how to do the same for local IPs. I don't have access to the router control panel, and am using a mac.

Thank you.

ip lan vlan configuration name-resolving

asked 22 Jul '17, 19:22

johntheone88
6●2●2●4
accept rate: 0%

One Answer:

Once you have enabled "Resolve Network Address" under Name Resolution in the View menu, you can right-click on the private IP address and click on "Edit Resolved name". There you will get an edit bar at the top to display whatever you wish.

answered 22 Jul '17, 20:56

Rooster_50
238●9●12●18
accept rate: 15%

Thank you for your message — unfortunately, I'm looking for the name to be automatically displayed, as I have no idea what the names of the internal IPs are (I'm sure there's some way to check using a 3rd party tool, but I'd like it to be automatic, if possible)

(22 Jul '17, 22:58) johntheone88

unfortunately, I'm looking for the name to be automatically displayed, as I have no idea what the names of the internal IPs are

In order for the name to be automatically displayed:

somebody has to have an idea what the names of the internal IPs are;
that somebody has to make that information available in some form that Wireshark can access.

So the first step is to find that somebody and ask them where to get the mappings of IP addresses to names in a form that Wireshark can use (which would either be a hosts file or a DNS server).

(23 Jul '17, 11:48) Guy Harris ♦♦

If the devices obtain IP address via DHCP, some DHCP servers can set a DNS Dynamic update (A and PTR record). This would allow Wireshark (if querying the local DNS server) to resolve the internal addresses.

(23 Jul '17, 20:17) Rooster_50