Ask Your Question
0

Is it possible to use an arp cache in your profile?

asked 2019-08-09 03:40:46 +0000

Ross Jacobs gravatar image

According to the docs, it looks like the system provides arp translations. Is it possible to access this via a profile file (to save/load for a specific capture)?

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
1

answered 2019-08-13 03:01:13 +0000

Hi Ross,

I did misunderstand. I couldn't think of an exemple where you would need this ARP information cached.

As far as I know there are no files you can use for that.

It is a "system service" so your computer does it on the fly for Wireshark.

Cheers,

JFD

edit flag offensive delete link more

Comments

You had me at no :)

Ross Jacobs gravatar imageRoss Jacobs ( 2019-08-13 03:04:19 +0000 )edit
0

answered 2019-08-13 02:45:02 +0000

updated 2019-08-13 02:45:29 +0000

Hi Ross,

You can put your own ethers file in your Personal Configuration folder. (Help -> About Wireshark -> Folders)

This file will be used by all profiles. I don't think there's a way to have one file per profile.

You have to manually overwrite the file if you need to use a different one.

Then again, MAC addresses are supposed to be unique so you might be fine with the one file.

Hope this helps.

Cheers,

JFD

edit flag offensive delete link more

Comments

Hi JFD,

I think you may be misunderstanding the question. ARP and ethers entries are different. Per the documentation, an entry in ethers looks like

e.g. 00:09:5b:01:02:03 → homerouter

An ARP entry is going to be a mapping from MAC to IP like

00:09:5b:01:02:03 → 1.2.3.4

Please note that this is a more academic question of whether it is possible to use have an ARP cache in your profile. If I were using name resolution for MAC addresses, ethers makes more sense to use. The lack of responses (and the lack of documentation on this question) makes me think that ARP caches are not a profile component.

I also don't see why this feature would be added as ethers arguably provides better information.

Cheers, Ross

Ross Jacobs gravatar imageRoss Jacobs ( 2019-08-13 02:52:42 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-08-09 03:40:46 +0000

Seen: 48 times

Last updated: Aug 13