Revision history [back]

Target IP address: jw-pi01.local (192.168.7.5) field is arp.dst.proto_ipv4 defined in packet-arp.c:

    { &hf_arp_dst_proto_ipv4,
      { "Target IP address",            "arp.dst.proto_ipv4",
        FT_IPv4,        BASE_NONE,      NULL,   0x0,
        NULL, HFILL }},

proto_item_fill_label() in proto.c formats the string and calls for name resolution:

        case FT_IPv4:
            ipv4 = fvalue_get_uinteger(&fi->value);

            addr.type = AT_IPv4;
            addr.len  = 4;
            addr.data = &ipv4;

            if (hfinfo->display == BASE_NETMASK) {
                addr_str = (char*)address_to_str(NULL, &addr);
            } else {
                addr_str = (char*)address_with_resolution_to_str(NULL, &addr);
            }
            g_snprintf(label_str, ITEM_LABEL_LENGTH,
                   "%s: %s", hfinfo->name, addr_str);
            wmem_free(NULL, addr_str);
            break;

If you are open to a Lua plugin, arp_host.lua available in the Contrib section of the Wireshark wiki, will add a new field arp_host.target that copies in the formatted/resolved address which can be added as a column and filtered on.