Ethereal-dev: Re: [Ethereal-dev] HW address resolving mechanism

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 20 Jan 2005 04:26:18 -0800
Jaap Keuter wrote:

I've run into trouble with the Hardware to IP address resolution mechanism
in Ethereal (check the column Hardware address resolved). It gets confused
if multiple LAN's (VLAN's) are present on the same wire. An interface
seems to get related to the first IP address seen on a packet from that
interface. Can anyone point me to where this resolution mechanism is, and
where it gets its knowledge from?

ARP packets. If Ethereal sees an ARP packet that indicates the MAC address corresponding to a given IP address, it'll say the name corresponding to that IP address also corresponds to the host name.