Situation: we have a host with a dynamic ip, e.g today 8.8.1.2, tomorrow 8.8.3.200. The subnet is the same 8.8.0.0/16. During the live capture we need to spot (notice) that we have one of the hosts belonging to 8.8.0.0/16 subnet. , but it does not work... asked 23 Feb '12, 22:10  contradictor_ |
2 Answers:
You can't do this in the hosts file. According to the Wireshark help file (I've never done it), you can do this in the subnets file using the syntax "8.8.0.0/16 subnetname". Note that this will only work as long as there is not an exact match from the hosts file or from DNS. If there is an exact match, that name will be displayed. Why not just use the display filter? That seems like the quickest, easiest way to spot a host belonging to a particular subnet. If you use partial name resolution using the subnets file, you might not notice a host belonging to the subnet of interest during a live capture if there is a lot of other traffic and the display is scrolling quickly. If you apply the display filter, you will see the traffic from that subnet, since it will be the only traffic displayed. Even in a saved capture file it might be hard to spot the host you're interested in if its traffic is mixed in with a lot of traffic from other subnets, unless you use a display filter. answered 24 Feb '12, 13:53  Jim Aragon |
It's possible to generate a HOSTS file with (255x255=65025) 65025 entries like this Will this be too hard for wireshark to manage? The hardware is ok. answered 26 Feb '12, 03:47 contradictor_ edited 26 Feb '12, 03:48 1 Don't know. I haven't heard of anyone trying to use a Wireshark hosts file that large. Try it and let us know. Here's another possibility to highlight traffic from the systems you're interested in. Create a coloring rule and put it at the top of the coloring rule list. Something like "ip.src==8.8.0.0/16". (26 Feb '12, 10:19) Jim Aragon |
Thanks... I'm not waiting for a specific subnet host. I'm planning to make a list of around 50 subnets(giving a nickname to each) and want to instantly see the nickname when one of these 50 subnets appears."A lot of traffic" is already filtered out. And following display filter could do the job ip.addr==9.9.0.0/16 or ip.addr==8.8.0.0/16 or ip.addr==7.7.0.0/16 ... (specifing 50 subnets in one filter). Thanks again.
If that's the case, then it sounds like the subnets file is exactly what you want. After I posted my answer, I was able to test, and it worked with no problems on the first try.
It's true, that " this will only work as long as there is not an exact match from the hosts file or from DNS. If there is an exact match, that name will be displayed." So my assigned NICKNAMES for subnets do NOT appear, if wireshark can resolve from DNS =(