Wireshark · Ethereal-users: Re: [Ethereal-users] How does ethereal reslove addresses to computer name

[Guy Harris <guy@xxxxxxxxxx>]

On Thu, Aug 08, 2002 at 12:57:28PM -0500, Sauron wrote:
> I'm using Ethereal with WinXP. MAC addresses and IP addresses 
> from my network show up in Ethereal with the Windows' "computer 
> name" that was entered into each of the machines. Where does 
> Ethereal get that information? I don't see it in the packets.

To resolve IP addresses to names, Ethereal calls the routine
"gethostbyaddr()", which is part of the OS on UNIX and Windows.

That routine might:

	look up the address in the hosts file;

	do a DNS query to look up the name;

	on UNIX, do an NIS query to look up the name;

	on Windows, do a NetBIOS "lookup" to look up the name.

If it sees ARP packets in the capture, it might also use information
from that to associate MAC addresses with IP addresses, and thus
associate names for IP addresses with MAC addresses.