ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Support for IAB MAC addresses?

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 18 Jun 2008 19:17:45 +0200
Hi,

Add an enhancement request to the bug database, and also refer to bug 2619, since this also lists enhancements/fixes for manuf

Thanx,
Jaap

Thomas Boehne wrote:
Hi,
I found the MAC address database in wireshark very useful, because it
often helps to identify to which device a certain IP address belongs
(especially in DHCP environments with broken dynamic-DNS updates).

Currently, wireshark only uses the OUI listings provided by IEEE. IEEE
also provides listings with the IABs in the same format as the OUI
listings. For more information on IABs, see
http://standards.ieee.org/regauth/faqs.html#q10 . Basically IABs are
small MAC address range for small companies (4096 MACs per IAB, as
opposed to 16 million per OUI).

The list of IABs is available at:

http://standards.ieee.org/regauth/oui/iab.txt

The current OUI list has 11580 entries, the current IAB list has 2351
entries.
I think it would be trivial to add MAC-Address lookup support for the
IAB address range, but the lookup table would grow significantly -
this might lead to worse performance. On the other hand, for best
possible performace MAC address resolution should be turned off
anyway.
Should IAB lookup support be added to wireshark? Should it be enabled
by default? I would volunteer to implement it, but I don't have good
tools to test performance degradation.

If this feature has been discussed before, please let me know - I did
not find any threads about it.

Best regards
Thomas Böhne