tshark view mac address (vendor) name

edit

It makes one wonder why there are no src, dst or addr OUI filters available along with their fully resolved counterparts. Filters like eth.src.oui_resolved contains "Cisco" or eth.addr.oui_resolved ~ "Microsoft Corp". might then be possible. Possible new filters:

eth.src.oui
eth.src.oui_resolved
eth.dst.oui
eth.dst.oui_resolved
eth.addr.oui
eth.addr.oui_resolved

If this is a feature of interest, then I'd suggest opening up a Wireshark enhancement bug request for it at https://bugs.wireshark.org/bugzilla/.

Because you can already do that with eth.src_resolved and eth.dst_resolved?

Those filters do not yield resolved OUI's. They give you a highly truncated resolved OUI, combined with the remaining 3 bytes of the MAC address, which isn't the same thing. There are a number of other filterable OUI fields, so it's somewhat surprising to me that there are no Ethernet filterable OUI fields.

$ tshark -G fields | grep OUI | wc -l
63

I was referring to filter expressions like eth.src_resolved contains "Cisco" are already possible.

I assume the prevailing use case is filtering on the actual OUI octets, such as eth.src[0:3] == 00:16:47

Yes, that's true, but a filter such as eth.src_resolved contains "Cisco Systems" wouldn't work because the OUI name is truncated, nor would a filter such as eth.src_resolved == "Cisco Systems, Inc" or even eth.src_resolved ~ "Inc$" because of the extra 3 bytes of the MAC address included in that filter.

And you can't necessarily search very effectively for all "Cisco Systems, Inc" OUI's using a filter such as eth.src[0:3] == 00:16:47 considering the number of Cisco-assigned OUI's:

$ grep "Cisco Systems, Inc" manuf | wc -l
822

By the way, the longest manufacturer's name appears to be 88 characters in length, so if truncated names is to be avoided, the MAXNAMELEN may need to be increased to accommodate it or a different value defined specifically for manufacturer's names.

$ grep -v "^#" manuf | cut -f 3 | sort -u | awk '{print length, $0 }' | sort -n | tail -1
88 Beijing National Railway Research & Design Institute of Signal & Communication Co., Ltd.

Probably there's no need for filtering for eth.src_resolved == "Cisco Systems, Inc", as this would leave out about a 100 other Cisco related OUI's. Try grepping for "Cisco" in manuf.

That being said, I'm not against adding this to the ethernet address dissection, but I don't see a big demand for it either. Otherwise it would have been an obvious addition created years ago already.

For what it's worth, bug 15300 and bug 15393 have been filed as a direct result of this question being asked.