Wireshark-dev: Re: [Wireshark-dev] Enhancement suggestion: OUI tool for IPV6 SLAAC addresses

From: João Valverde <joao.valverde@xxxxxxxxxxxxxxxxxx>
Date: Tue, 3 Aug 2021 15:01:45 +0100


On 31/07/21 01:56, Marco Davids (SIDN) wrote:
Op 30-07-21 om 21:10 schreef João Valverde via Wireshark-dev:

Also, I have not find any aggregate statistics just yet. But nevertheless still happy with this nice feature.


The statistics for SLAAC/OUI don't exist. What I was trying to say is that, if we were to add something like that, I think they should go somewhere under the IPv6 Statistics menu, not Endpoints.

Ah okay. Got you. Thanks.

One final question; I can't seem to do name resolution with thsark on the mac addresses I derive from IPv6 SLAAC addresses.

So I can do this:

tshark -r ~/ipv6.pcap -2 -R 'ipv6.dst_sa_mac' -Tfields -eipv6.dst_sa_mac

or this:

tshark -Y 'ipv6.dst_sa_mac' -Tfields -eipv6.dst_sa_mac

And that results in a nice list of MAC addresses in the output.

But adding "-o 'nameres.mac_name:TRUE'" or "-Nm" does not help to cause manufacturer name resolution to happen on these mac addresses.

It does work for "-e eth.addr_resolved", but obviously this options concerns other MAC addresses.

Is what I would like to do at all possible, or is that specific use case something that tshark currently does not support?

Apparently it's not supported. I'm not sure if this limitation is intended behavior or not. Few addresses other than Ethernet have an extra "resolved" field attached.

A work-around is to use:

tshark -Y 'ipv6.dst_sa_mac' -Nm -O ipv6 | grep '\[SA MAC'