Missing MAC addresses in pcap.

asked 2023-06-02 13:42:17 +0000

Recently all of my clients have been sending pcaps that appear to be missing MAC addresses. I'll have 10 MAC and 100 IPs. At first I thought maybe this was a user error at the time of collection and they were filtering out Layer 2, but it's started happening all of the sudden, among different clients, using different switch vendors.

I am starting to wonder if a new Wireshark update might have changed some default capture settings. Has anyone else experienced this?

edit retag flag offensive close merge delete

Comments

What do you mean by "missing MACs"? How have you determined the MAC address is missing?

grahamb ( 2023-06-02 13:44:39 +0000 )edit

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2023-06-02 15:23:32 +0000

chronicinquiry
1 ●1 ●1

When I go to Statistics > Endpoint, there aren't MAC addresses for every IP. I think I figured it out. They are collecting the traffic that has passed through a router, so the MACs have been dropped.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-06-02 13:42:17 +0000

Seen: 424 times

Last updated: Jun 02 '23

Missing MAC addresses in pcap. edit