Quantcast
Channel: Ask Wireshark - RSS feed
Viewing all articles
Browse latest Browse all 11

tshark view mac address (vendor) name

$
0
0
I'm new to tshark and trying to print out unique IP address and it's MAC address together with the vendor of that MAC address. This is what I can do for now c:\pcap>tshark -r input.pcap -T fields -e eth.src -e ip.src -e eth.dst -e ip.dst | sort | uniq -c 25 00:01:42:00:01:42 10.1.1.1 00:0D:3a:00:0D:3a 172.16.1.1 12 00:0D:3a:00:0D:3a 172.16.1.1 00:01:42:00:01:42 10.1.1.1 c:\pcap> **Desired Output** 25 00:01:42:00:01:42 Cisco Systems, Inc. 10.1.1.1 00:0D:3a:00:0D:3a Microsoft Corp. 172.16.1.1 12 00:0D:3a:00:0D:3a Microsoft Corp. 172.16.1.1 00:01:42:00:01:42 Cisco Systems, Inc. 10.1.1.1 Is this possible? If yes, please let me know how to accomplish it using tshark. Thanks

Viewing all articles
Browse latest Browse all 11

Latest Images

Trending Articles





Latest Images