Where does the "Resolved Addresses" option on the statistics menu get it's information?

retag add tags

I see information here that I cant find in the trace. i.e. services, and mac addresses. So where does all the info in the file come from?

From the Wireshark man page, search for "FILES" and you will come across the documentation for the various files that Wireshark uses for various name resolution capability.

For example:

Name Resolution (hosts)
Name Resolution (subnets)
Name Resolution (ethers)
Name Resolution (manuf)
Name Resolution (services)
Name Resolution (ipxnets)

The 2 you mentioned specifically are handled by the services and manuf files:

The services file is used to translate port numbers into names. Both the global services file and personal services files are used if they exist.

The manuf file is used to match the 3-byte vendor portion of a 6-byte hardware address with the manufacturer's name; it can also contain well-known MAC addresses and address ranges specified with a netmask. The manuf file is looked for in the same directory as the global preferences file.

11.1k

cmaynard

answered 2018-07-18 21:09:38 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Where does the "Resolved Addresses" option on the statistics menu get it's information? edit

Comments

1 Answer

Comments