Re: [Ethereal-users] getting MAC addresses from ethereal

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Jan 24, 2002 at 07:52:14PM -0800, Rakesh Arora wrote:
>       I am using both ethereal and tethereal and I
> want to get the MAC addresses of the nodes. So for
> ethereal, I check the "Enable MAC name resolution"
> checkbox but still I get IP addresses most of the
> time. If I check the details of a conversation, then I
> can see the MAC address, but I want the MAC address to
> appear in the summary line. 

The "Enable MAC name resolution" flag has no effect whatsoever on what
address appears in the summary line.  It merely controls whether, when
Ethereal *does* display a MAC address, it attempts to convert it to a
name; it's not supposed to change whether the "Source" or "Destination"
column displays network-layer or link-layer addresses.

To change what displays in the summary line, you need to change the
columns in the summary line, with the "Columns" item in the
"Preferences" dialog box, popped up when you select "Preferences" from
the "Edit" menu.

If you want to see the source MAC address of a packet, select "Hardware
src addr" from the "Column format:" menu, type the name you want that
column to have in the "Column title:" text field, and click the "New"
button; it'll add a new item to the list of column titles it displays. 
Use the "Up" and "Down" buttons to move that item - the topmost item is
the leftmost column.  Select a column and click the "Delete" button to
delete a column; select a column, change the "Column title:" field or
the "Column format:" field, and click the "Change" button to change a
column.

To see the destination MAC address of a packet, use "Hardware dest addr"
rather than "Hardware src addr".

This will *NOT* change what's currently displayed.  You must click the
"Save" button, exit from Ethereal, and re-start Ethereal to get the new
list of columns.  (Yes, this is ugly; it will probably be fixed
eventually, but the right way to fix it involves replacing the widget
used to display the list of packets; that fix will improve a number of
things, but it's still very much a work in progress.)

>       Same goes for tethereal. I use the -Nm option to
> give me the MAC address but it doesn't happen.

Tethereal displays the same columns that Ethereal does, so changing the
columns as described above will affect it (and changing whether MAC
addresses are resolved to names will, as with Ethereal, *NOT* change
whether the source address or destination address columns display MAC
addresses).