It would be super cool if I could alias transmitter and receiver MAC addresses in 802.11 captures. Tracking MAC addresses is pretty hard... but if I could call an access point "AP01" and a client "MacBook", that would make reading PCAPs super slick.
I tried using both "ethers" and "hosts", but the changes don't seem to reflect anywhere in Wireshark. Am I doing something wrong?
Example for MAC OS X:
MacPrompt$ cat /Users/bob/.wireshark/ethers
7c:8b:10:0f:97:b5 Test_MAC
The restart Wireshark, and all is good:
Note that this works for all MAC-48 addresses, not just 802.11 addresses; it also handles, for example, Ethernet addresses.
Note also that, on UN*Xes (Linux, macOS, *BSD, Solaris, HP-UX, AIX, etc.), if you have a ~/.config/wireshark directory, the ethers file will be in that directory rather than in ~/.wireshark.
Asked: 2018-08-15 20:55:48 +0000
Seen: 776 times
Last updated: Aug 15 '18
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Operating system? Tested on a Mac with current version and it works OK. Are you on Windows, Linux?
Hey Bob, I'm using macOS 10.13.6. Are you using "ethers" or "hosts"? Would you be willing to paste in an example? I must be doing something wrong.