This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How does Wireshark identify the Router’s brand?

0

I started a packet capture on my PC. Wireshark shows as packets coming from NetGear something.I was curious as to how Wireshark identifies the Router's brand?

asked 17 Feb '15, 18:55

user0912's gravatar image

user0912
6●1●1●3
accept rate: 0%

One Answer:

2

I imagine you are seeing the manufacturer's name as part of the Ethernet MAC (src/dst) addresses in a packet.

Every Ethernet hardware port has a unique MAC address with the first 3 bytes being a specific value assigned to a manufacturer and the last 3 bytes being assigned by the manufacturer.

Wireshark looks up the first 3 bytes of the Ethernet address in a table to determine the manufacturer.

This can be disabled in the Edit ! Preferences ! Name Resolution screen in Wireshark.

answered 17 Feb '15, 19:37

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k●1●8●50
accept rate: 17%

edited 17 Feb '15, 19:47