Wireshark · Ethereal-users: Re: [Ethereal-users] Ethernet II src Vs Internet Protocal Src

[julien.leproust@xxxxxxxx]

Tomás Mac Eoin a écrit :
> What is the Difference between the Ethernet II source and the Internet 
> Protocol Source.
>  
> I am seeing lots of TCP Port 135 packates on out network.
>  
> However the Ethernet II Src IP address is different from the Ethernet 
> Protocol Source address.
>  
> The Ethernet II Src address is belonging to our network while the 
> Ethernet Protocol src Address is from an external network.
>  
> The Destination address of both is the same and is located on our network.
>  
> Can anyone explain why there are two source addresses.

Hello,

Are you speaking of Ethernet MAC addresses (6 bytes, for example 
00:01:02:03:04:05) or IP addresses (4 bytes, for example 192.168.0.1) ?

Ethereal tries to resolve Ethernet MAC addresses to corresponding IP 
addresses (and IP address to DNS names if activated) so you might see 
wrong IP addresses resolved by ethereal. It should work nicely with a 
workstation with only one MAC address and one IP address, but Ethereal 
could be wrong with routed addresses, as several IP addresses appear for 
the same MAC address.

Regards,

--
Julien Leproust
Ercom S.A.