Wireshark-users: Re: [Wireshark-users] 2 questions

Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 30 Dec 2023 23:27:09 -0800
On Dec 30, 2023, at 6:36 PM, Jean-Michel Collard <jm@xxxxxxxxxxxxxxxx> wrote:

> First of all : Happy New Year to everyone 🙂

Happy New Year to you too!  (Or "have a Happy New Year", as it's now still 2023-12-30 23:04 local time here. :-))

> Why Wireshark display IPv1/v6 addresses instead of hostnames (if any)?

Because either

	1) you don't have network-layer host name resolution enabled

or

	2) it's enabled, but Wireshark couldn't translate the IP address to a host name.

> Can it be configured to have this ?

To make sure network host name resolution is enabled:

	select "Preferences" from the "Edit" menu (Windows, Linux, everything else other than macOS) or the "Wireshark" menu (macOS);

	select "Name Resolution" from the Preferences dialog;

	make sure that "Resolve network (IP) addresses" is checked;

	make sure that "Use your system's DNS settings for name resolution" is checked;

	click the "OK" button.

If that doesn't cause it to resolve IP addresses, it's probably because whatever DNS server your system's DNS settings use can't resolve the addresses.

> When one right click on a packet there is no whois ?

I don't think there's a "whois" menu item in Wireshark.

> I know there are already a lot of things with a right-click.

There are, but "whois" isn't one of them.  There may have, in the past, been a "resolve IP address(es)" option, but it doesn't appear to be there now.