Ethereal-users: [Ethereal-users] Display - packet details question..

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Jemiolo, John" <john.jemiolo@xxxxxx>
Date: Tue, 29 Mar 2005 09:13:48 -0500
Title: Display - packet details question..

Two questions about looking at the packet details for an ARP request.

1.      In the packet details I can see the source: MAC translation to the abreviated MFG's name surrounded by ( ) "Example: Source: 00:0e:7f:xx:xx:xx  (HewlettP_xx:xx:xx)".  From the users manual I'm assuming that this is an internal ethereal conversion.  This translation is performed if the MAC address ARP fails for ethereal?


2.      A few "ARP request" in packet details, display an IP in  ()  after the source: Mac address, "Example: Source: 00:0e:7f:xx:xx:xx ( #.#.#.# )".   Am I correct in assuming this was MAC - IP translation was done by ethereal performing a sucessful  ARP?  and this data is recorded in the capture file?  

Thanks
JJ