Wireshark-users: Re: [Wireshark-users] tethereal get MAC address
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 19 Mar 2009 17:22:01 -0700

On Mar 19, 2009, at 4:01 PM, Chris Henderson wrote:


Is there any way to get the MAC address? At the moment I can only see
IPs but no MAC. I'm running: tethereal -i eth0 -n port 68 -Nmt.
tshark -i eth0 -n port 68 -Nmt -o column.format:'"No.","%m","Time","%t","Source MAC","%hs","Destination MAC","%hd","Source","%s","Destination","%d","Protocol","%p","Info","%i"'
The fact that I said "tshark" rather than "tethereal" is significant - the ability to change the columns from the command line was, as I remember, added *after* Ethereal was renamed to Wireshark. Get a recent version of Wireshark and try the above. (It'll print the MAC addresses twice for packets with no network-layer headers; replace "%s" with "%ns" and "%d" with "%nd" to have it print the network-layer addresses in those columns, or print nothing if no network-layer headers are present.)