Wireshark-dev: Re: [Wireshark-dev] Machine on which wireshark capturing has been done
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 21 Aug 2014 01:42:21 -0700
On Aug 21, 2014, at 1:30 AM, Vishnu Bhatt <vishnu.bhatt@xxxxxxxxxxx> wrote:

> Hello,
>  
> I have a pcap file and I want to know on which machine is the file has been captured.
> Is there a way to know the Mac or IP address of the machine/switch on which the file has been taken?

Not reliably; the pcap file format:

	http://www.tcpdump.org/manpages/pcap-savefile.5.html

does not include any information to identify the machine on which the file has been captured.

You *might* be able to infer it by looking for, for example, packets less than 60 bytes in an Ethernet capture, as those are probably outgoing packets, in which case the source MAC address will be the MAC address of the interface on which the packet was sent out.  There's no guarantee that this will work, however.

For a pcap-ng file:

	http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

the Section Header Block might give some information about the machine on which the packet capture was done, and the Interface Description Blocks (possibly plural!) might give the IP and/or MAC addresses of the interfaces on which the capture was done, but those are all options and are not guaranteed to be in the capture file, so you might have to rely on hacks such as the one I described above for pcap files.