On Mar 19, 2009, at 4:01 PM, Chris Henderson wrote:
Is there any way to get the MAC address? At the moment I can only see
IPs but no MAC. I'm running: tethereal -i eth0 -n port 68 -Nmt.
tshark -i eth0 -n port 68 -Nmt -o
column.format:'"No.","%m","Time","%t","Source MAC","%hs","Destination
MAC","%hd","Source","%s","Destination","%d","Protocol","%p","Info","%i"'
The fact that I said "tshark" rather than "tethereal" is significant -
the ability to change the columns from the command line was, as I
remember, added *after* Ethereal was renamed to Wireshark. Get a
recent version of Wireshark and try the above. (It'll print the MAC
addresses twice for packets with no network-layer headers; replace
"%s" with "%ns" and "%d" with "%nd" to have it print the network-layer
addresses in those columns, or print nothing if no network-layer
headers are present.)
