Wireshark · Ethereal-users: Re: [Ethereal-users] Request ethereal wrong ethernet adresses

[Guy Harris <gharris@xxxxxxxxx>]

Casier Geert (bizinc) wrote:

> Using  HP_UX 11.11 OS witch ethereal version 0.9.15
> we ' ve found that 
> the mac source ethernet adresses change all the time  for
> whatever station during a capture session.

I.e., the address shown in the packet details window changes for packets 
 coming from the same IP address?

What happens if you capture the traffic with tcpdump and then read it in 
Ethereal?  If you see the same problem, then...

> We suppose this is a bug or wrong configuration in Ethereal
> since there is nothing wrong with the mac adresses on the particular
> workstation ....

...it's probably not a problem with Ethereal.

Note, however, that if the machine sending the packets isn't on the same 
LAN segment as the machine running the program doing the capturing, the 
MAC address on the packets will be the MAC address of the router through 
which the packets are passing, not the MAC address of the machine 
sending the packets, in which case it could just be that the routes are 
changing.