First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Can I map MAC addresses to names?

  • retag add tags

It would be super cool if I could alias transmitter and receiver MAC addresses in 802.11 captures. Tracking MAC addresses is pretty hard... but if I could call an access point "AP01" and a client "MacBook", that would make reading PCAPs super slick.

I tried using both "ethers" and "hosts", but the changes don't seem to reflect anywhere in Wireshark. Am I doing something wrong?

PotatoFi's avatar
3
PotatoFi
asked 2018-08-15 20:55:48 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2018-08-15 23:51:44 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Operating system? Tested on a Mac with current version and it works OK. Are you on Windows, Linux?

Bob Jones's avatar Bob Jones (2018-08-15 22:01:13 +0000) edit

Hey Bob, I'm using macOS 10.13.6. Are you using "ethers" or "hosts"? Would you be willing to paste in an example? I must be doing something wrong.

PotatoFi's avatar PotatoFi (2018-08-15 22:04:00 +0000) edit
add a comment see more comments

1 Answer

1

Example for MAC OS X:

MacPrompt$ cat /Users/bob/.wireshark/ethers

7c:8b:10:0f:97:b5   Test_MAC

The restart Wireshark, and all is good:

image description

Bob Jones's avatar
1.5k
Bob Jones
answered 2018-08-15 22:31:51 +0000
edit flag offensive 0 remove flag delete link

Comments

Note that this works for all MAC-48 addresses, not just 802.11 addresses; it also handles, for example, Ethernet addresses.

Guy Harris's avatar Guy Harris (2018-08-15 23:52:54 +0000) edit

Note also that, on UN*Xes (Linux, macOS, *BSD, Solaris, HP-UX, AIX, etc.), if you have a ~/.config/wireshark directory, the ethers file will be in that directory rather than in ~/.wireshark.

Guy Harris's avatar Guy Harris (2018-08-15 23:54:26 +0000) edit

Hey Bob, using cat or nano worked great. I think using the macOS text editor was the problem. Thank you very much for your help!

PotatoFi's avatar PotatoFi (2018-08-17 15:19:54 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer