Ask Your Question
0

Can I map MAC addresses to names?

asked 2018-08-15 20:55:48 +0000

PotatoFi gravatar image

updated 2018-08-15 23:51:44 +0000

Guy Harris gravatar image

It would be super cool if I could alias transmitter and receiver MAC addresses in 802.11 captures. Tracking MAC addresses is pretty hard... but if I could call an access point "AP01" and a client "MacBook", that would make reading PCAPs super slick.

I tried using both "ethers" and "hosts", but the changes don't seem to reflect anywhere in Wireshark. Am I doing something wrong?

edit retag flag offensive close merge delete

Comments

Operating system? Tested on a Mac with current version and it works OK. Are you on Windows, Linux?

Bob Jones gravatar imageBob Jones ( 2018-08-15 22:01:13 +0000 )edit

Hey Bob, I'm using macOS 10.13.6. Are you using "ethers" or "hosts"? Would you be willing to paste in an example? I must be doing something wrong.

PotatoFi gravatar imagePotatoFi ( 2018-08-15 22:04:00 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
1

answered 2018-08-15 22:31:51 +0000

Bob Jones gravatar image

Example for MAC OS X:

MacPrompt$ cat /Users/bob/.wireshark/ethers

7c:8b:10:0f:97:b5   Test_MAC

The restart Wireshark, and all is good:

image description

edit flag offensive delete link more

Comments

Note that this works for all MAC-48 addresses, not just 802.11 addresses; it also handles, for example, Ethernet addresses.

Guy Harris gravatar imageGuy Harris ( 2018-08-15 23:52:54 +0000 )edit

Note also that, on UN*Xes (Linux, macOS, *BSD, Solaris, HP-UX, AIX, etc.), if you have a ~/.config/wireshark directory, the ethers file will be in that directory rather than in ~/.wireshark.

Guy Harris gravatar imageGuy Harris ( 2018-08-15 23:54:26 +0000 )edit

Hey Bob, using cat or nano worked great. I think using the macOS text editor was the problem. Thank you very much for your help!

PotatoFi gravatar imagePotatoFi ( 2018-08-17 15:19:54 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

subscribe to rss feed

Stats

Asked: 2018-08-15 20:55:48 +0000

Seen: 969 times

Last updated: Aug 15 '18