Statistics / Conversations / Name Resolution

asked 2017-11-28 21:03:18 +0000

I'm having trouble getting name resolution to work on newer versions of Wireshark.

Versions 2.0.6, 2.0.11, 2.0.16 work fine. Statistics/Conversations/Name Resolution I can toggle the Name Resolution check box on and off during a live capture and it appears to work fine.

These are the versions I'm struggling with, 2.1.1, 2.2.0, 2.2.5, 2.2.10, 2.4.2
The Name Resolution check box, 'unchecks' itself in the following versions listed below. When I stop the capture, the Name Resolution box can be toggled and it resolves the IP addresses.

Thank you !

edit retag flag offensive close merge delete


Which "Name Resolution" checkbox would that be, there are a few to choose from, I'd guess that you mean "Resolve network (IP) addresses"?

Can you also me a bit more specific about the exact sequence of operations you're attempting to do?

grahamb gravatar imagegrahamb ( 2017-11-29 10:10:19 +0000 )edit

Hello grahamb, I'm using the default installation v2.4.2

[Preferences] 1. click Edit on the toolbar 2. click on Preferences 3. click on Name resolution 4. All of the Name Resolution boxes are checked/selected ( Resolve MAC addresses, Resolve transport names, Resolve network (IP) addresses, Use captured DNS packet data for address resolution, Use an external network name resolver

[Capture] 1. I start a capture 2. On the toolbar, I click Statistics, then Conversations 3. The Conversations windows has three boxes at the bottom, Name resolution, Limit to display filter, and Absolute start time. 4. I click on Name resolution, the box has a check it in for about a half a second and then the check box clears itself. For the half a second, names to resolve in the Conversation window, but then only IP addresses when the box automatically unchecks itself. 5. If I stop the ...(more)

bjohnsonta gravatar imagebjohnsonta ( 2017-11-30 15:24:33 +0000 )edit

I missed that you were referring to the Conversations dialog. Unfortunately the User's Guide isn't very helpful either.

I suspect that checking the box allows a "one-time" run of name resolution for the current hosts in the dialog, but I'd have to check the code to be sure.

grahamb gravatar imagegrahamb ( 2017-11-30 15:47:16 +0000 )edit