We all want to work as efficiently as possible. After spending too much time staring at Wireshark pcap files and straining my eyes over frame exchanges, I got tired of looking for that MAC address I can never remember.
In Wireshark, this is called Ethernet Name Resolution.
Wireshark allows you to create custom name resolution. Instead of looking for a MAC address such as 7e:18:3c:1d:bb:51, I can have it stick out and say ROWELL_IPHONEXR.
I’m on MacOS. The easy way is to open terminal and navigate to where the Wireshark personalization files are which is:
You may or may not have a file named ethers. If not, create one and we can add our MAC layer name resolution:
Next, you can add each MAC address and the name you want it to resolve to such as:
Enter each resolution on its own line starting with the MAC address. Enter a single space and type in the name you desire. The name cannot contain a space character.
Save the file:
Next, restart Wireshark and check out the difference.
Leave a Reply