> >The *ONLY* way you get that in Ethereal is if Ethereal happens to see an
> >ARP packet that specifies that a given MAC address is the MAC address
> >for a given IP address. There is no other way to do that.
>
> So I can't edit my Linux files such as /etc/networks as Ethereal does not
> search there.
Ethereal doesn't *itself* search those files. ("/etc/networks" won't
help in any case, as that's not for hosts.)
It calls "gethostbyaddr()" to translate IP addresses to host names;
whether *that* routine searches "/etc/hosts" or not is most likely to be
controlled by the "hosts:" line in "/etc/nsswitch.conf" (if it includes
"hosts", it'll search "/etc/hosts").
> Then how can I make these ARP packets (maybe I can make a script ).
"arp -d <hostname>", where "<hostname>" is the host name of the host
you're trying to look up, then try to ping that host's IP address.
> >What do you mean by "unable to display the IP addresses"?
>
> I am running some code which inserts am MPLS header between the Ethernet
> header and network layer header, then sends the packet out to its
> destination.
Presumably the packet in question has, in the Ethernet header's Ethernet
type field, the type for either an MPLS unicast packet (0x8847) or an
MPLS multicast packet (0x8848).
> There certainly is an IP header in the datagrams which contains source and
> destination addresses. However Ethereal only displays addresses for _these_
> packets w.r.t Ethernet MAC addresses. I believe the sandwiched header is
> 'confusing' Ethereal and some how it is unable to obtain all the IP
> information I want.
I believe that to be unlikely, given that the MPLS dissector does
call the IP dissector, and the IP dissector *ALWAYS* puts IP address
information into the protocol tree when constructing a protocol tree.
Please print, to a file, one of the packets you claim don't have IP
addresses in the protocol tree:
select the "Edit->Preferences" menu item;
select the "Printing" tab if it's not already selected;
click on the "File" button in the "Print to:" row;
put into the "File:" text box a pathname such as "/tmp/packet";
click the "OK" button;
select the packet in question;
select the "File->Print Packet" menu item.
"/tmp/packet" (or whatever the pathname you supplied was) should now
contain a text version of the protocol tree.
Then mail us that file.
> Perhaps the MPLS header is where Ethereal expects to see the IP header.
Ethereal will expect there to be an IP header immediately after the
Ethernet header only if the Ethernet type of the packet is the Ethernet
type for IPv4 (0x0800) or for IPv6 (0x06dd).
If the Ethernet type is the Ethernet type for MPLS unicast packets, i.e.
0x8847, Ethereal will expect there to be an MPLS header immediately
after the Ethernet header.
Currently, we don't handle the Ethernet type for MPLS multicast packets
(0x8848) for some reason; if those packets look exactly like MPLS
unicast packets, we should simply change the MPLS dissector code to
register itself to handle ETHERTYPE_MPLS_MULTI as well as
ETHERTYPE_MPLS.