Hi,
I found the MAC address database in wireshark very useful, because it
often helps to identify to which device a certain IP address belongs
(especially in DHCP environments with broken dynamic-DNS updates).
Currently, wireshark only uses the OUI listings provided by IEEE. IEEE
also provides listings with the IABs in the same format as the OUI
listings. For more information on IABs, see
http://standards.ieee.org/regauth/faqs.html#q10 . Basically IABs are
small MAC address range for small companies (4096 MACs per IAB, as
opposed to 16 million per OUI).
The list of IABs is available at:
http://standards.ieee.org/regauth/oui/iab.txt
The current OUI list has 11580 entries, the current IAB list has 2351
entries.
I think it would be trivial to add MAC-Address lookup support for the
IAB address range, but the lookup table would grow significantly -
this might lead to worse performance. On the other hand, for best
possible performace MAC address resolution should be turned off
anyway.
Should IAB lookup support be added to wireshark? Should it be enabled
by default? I would volunteer to implement it, but I don't have good
tools to test performance degradation.
If this feature has been discussed before, please let me know - I did
not find any threads about it.
Best regards
Thomas Böhne
--
**************************************************************************
* Jäger Computergesteuerte Messtechnik GmbH
* Thomas Böhne
* Rheinstraße 2-4
* 64653 Lorsch, Germany
* http://www.ADwin.de
* Phone: +49 (6251) 9632-0 Fax: +49 (6251) 56819
**************************************************************************
* Responsible: C.E.O. Hubert Morgenstern
* Commercial Register: Amtsgericht Bensheim, Register no.: B24717
**************************************************************************