Ethereal-users: Re: [Ethereal-users] Ethereal shows this machine name for IP 0.0.0.0

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Fri, 14 Dec 2001 13:58:36 -0800
At 01:10 PM 12/14/2001, Guy Harris wrote:

> Running Ethereal 0.8.19 on Win2K.
>
> Packets with a source IP address of 0.0.0.0 (primarily DHCP requests) show
> in the Source column the name of the machine on which Ethereal is running
> rather than the Ethernet address of the sending machine.

The Source column, by default, shows:

        the source network-layer address, if the packet has a
        network-layer header;

        the source link-layer address, otherwise.

The only way in which you would see the Ethernet address of the sending
machine would be if you'd reconfigured Ethereal to show, in the Source
column, link-layer addresses, rather than network-layer addresses; that
would mean that *all* packets would show the Ethernet address.  (There
is no mechanism in Ethereal for showing the Ethernet address for some IP
packets and the IP address for other IP packets.)
My original question wasn't clear enough. Ethereal converts a source IP address of 0.0.0.0 to the name of the machine on which Ethereal is running. Yes, technically 0.0.0.0 means "this host on this net", but when looking at packets on the network 0.0.0.0 will rarely really mean this machine and it is confusing to print the name of this machine. Wouldn't it be better not to convert 0.0.0.0 to a text name?