Ethereal-users: Re: [Ethereal-users] Ethereal shows this machine name for IP 0.0.0.0

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 14 Dec 2001 13:10:36 -0800 (PST)
> Running Ethereal 0.8.19 on Win2K.
> 
> Packets with a source IP address of 0.0.0.0 (primarily DHCP requests) show 
> in the Source column the name of the machine on which Ethereal is running 
> rather than the Ethernet address of the sending machine.

The Source column, by default, shows:

	the source network-layer address, if the packet has a
	network-layer header;

	the source link-layer address, otherwise.

The only way in which you would see the Ethernet address of the sending
machine would be if you'd reconfigured Ethereal to show, in the Source
column, link-layer addresses, rather than network-layer addresses; that
would mean that *all* packets would show the Ethernet address.  (There
is no mechanism in Ethereal for showing the Ethernet address for some IP
packets and the IP address for other IP packets.)