["Sake Blok" <sake@xxxxxxxxxx>]

If you trace packets which have been natted by the firewall, you will not be able to see the client mac-address nor the client ip-address in your trace. Either have a look at the nat and/or session table in the firewall to make the match real time or capture the traffic *before* the firewall NATs it.

 

Cheers,

    Sake

 

----- Original Message -----

From: Michael Egan

To: wireshark-users@xxxxxxxxxxxxx

Sent: Friday, April 17, 2009 4:00 PM

Subject: [Wireshark-users] Finding MAC address

I am monitoring packets that flow between our outer most router and our firewall.  When packets are flowing outbound the source IP address is the firewall.  I would like to know if there is a way to drill down to find the MAC address of the PC that sending out the packets?

 

Thanks,

Mike

 

Mike Egan
Enterprise Network Engineer 
Capital Safety 
3833 Sala Way
Red Wing, MN 55066
651-385-6254 Office
651-247-5719 Cell
michaele@xxxxxxxxxxxxxxxxx

Home of DBI-Sala and Protecta Brands.  Visit us on the web at www.capitalsafety.com 

---

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe