Wireshark-users: Re: [Wireshark-users] descriptive names for mac address

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Tue, 12 Jun 2007 17:02:50 -0700

On Wed, Jun 06, 2007 at 12:46:53AM +0200, Martin Andersson wrote:

> Is it possible (via a file for instance) to get descriptive names of 
> mac addresses in tshark.
> 
> Example:
> 
> Netgear_7e:39:d4 -> IntelCor_19:32:c3 LLC I, N(R)=0, N(S)=0; DSAP NULL 
> LSAP Individual, SSAP NULL LSAP Command
> 
> Should be something like
> 
> DeviceA -> DeviceB LLC I, N(R)=0, N(S)=0; DSAP NULL LSAP Individual, 
> SSAP NULL LSAP Command

Yes, using the personal "ethers" file.  The format is the same as the 
/etc/ethers file on a Unix machine (Basically a MAC address separated by 
colons, then a tab, then a descriptive name).  The location for this 
file on Windows and Unix can be found here:

http://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html


Steve