Ask Your Question
0

Resolved or Mapped ARP Target IP Address

asked 2021-03-29 13:54:50 +0000

juandering gravatar image

Is there a display filter that can be used to apply as column, the resolved or mapped host name for an ARP target IP address?

This string value is shown in the packet details window.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
1

answered 2021-03-30 02:38:12 +0000

Chuckc gravatar image

Target IP address: jw-pi01.local (192.168.7.5) field is arp.dst.proto_ipv4 defined in packet-arp.c:

    { &hf_arp_dst_proto_ipv4,
      { "Target IP address",            "arp.dst.proto_ipv4",
        FT_IPv4,        BASE_NONE,      NULL,   0x0,
        NULL, HFILL }},

proto_item_fill_label() in proto.c formats the string and calls for name resolution:

        case FT_IPv4:
            ipv4 = fvalue_get_uinteger(&fi->value);

            addr.type = AT_IPv4;
            addr.len  = 4;
            addr.data = &ipv4;

            if (hfinfo->display == BASE_NETMASK) {
                addr_str = (char*)address_to_str(NULL, &addr);
            } else {
                addr_str = (char*)address_with_resolution_to_str(NULL, &addr);
            }
            g_snprintf(label_str, ITEM_LABEL_LENGTH,
                   "%s: %s", hfinfo->name, addr_str);
            wmem_free(NULL, addr_str);
            break;

If you are open to a Lua plugin, arp_host.lua available in the Contrib section of the Wireshark wiki, will add a new field arp_host.target that copies in the formatted/resolved address which can be added as a column and filtered on.

edit flag offensive delete link more

Comments

Many thanks @Chuckc for all your efforts to address this issue. I have downloaded and tested the postdissector that you provided -- JWTDO!

juandering gravatar imagejuandering ( 2021-03-30 09:24:38 +0000 )edit
0

answered 2021-03-29 18:45:57 +0000

JasMan gravatar image

You can use the display filter "arp.opcode == 2" to show ARP replies only. To add the senders IP and mac address as column, select one packet, expand the "Address Resolution Protocol (reply)" section, rightclick on "Sender MAC address" and choose "Add as column". Do the same with "Sender IP address".

You can also use tshark (located in the installation folder of Wireshark) to export a list of all ARP replies from a capture file, containing the mac (arp.src.hw_mac) and IP addresses (arp.src.proto_ipv4):

tshark -r CaptureFile.pcapng -Y "arp.opcode == 2" -T fields -e arp.src.hw_mac -e arp.src.proto_ipv4

If you want to do this during a live capture, just replace "-r CaptureFile.pcapng" by "-i" followed by the ID or name of your LAN connection.

edit flag offensive delete link more

Comments

Thank you @JasMan for your advice; perhaps I was not really clear in describing my issue. @Chuckc has provided a more apt resolution.

juandering gravatar imagejuandering ( 2021-03-30 09:18:19 +0000 )edit

@Chuckc was able to understand your question, so I think your describing is clear and I've just misunderstood your question. :)

JasMan gravatar imageJasMan ( 2021-03-30 11:43:46 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-03-29 13:54:50 +0000

Seen: 92 times

Last updated: Mar 30