Hello,
i recently found out about the concept of MAC Locally vs Universally administered MAC addresses.
When analyzing a Wireshark trace from my WiFi, which captured my IPhone connecting to the network, i noticed that the phone used a locally administered MAC address for some ARP messages but the resolved name from WireShark showed MS-NLB-PhysServer (nothing to do with Iphone i guess...).
After reading on the web i thought that this resolution comes from some default Wireshark lookup tables, like the manuf file. However i could not find such entry in the file. Nether in the ether file, the other place where resolution can be defined.
So i wonder where does such name resolution come from and if there is any other configuration file in Wireshark that defines it.
As a bonus question :-)... If somebody could explain why I see the IPhone using two different MAC addresses (one is the universal/BIA and the other one is this locally administered MAC) it would be great. By the way the two source MAC addresses are obviously related, since they have the same last 8 digits, like in the example here below:
- Universal BIA => a8:be:27:xx:yy:zz
- Local => 02:0f:b5:xx:yy:zz
Thanks!
