Re: Enhancement suggestion: OUI tool for IPV6 SLAAC addresses

["Marco Davids \(SIDN\) via Wireshark-dev" <wireshark-dev () wireshark org>]

Op 30-07-21 om 21:10 schreef João Valverde via Wireshark-dev:

> > Also, I have not find any aggregate statistics just yet. But 
> > nevertheless still happy with this nice feature.
>
> The statistics for SLAAC/OUI don't exist. What I was trying to say is 
> that, if we were to add something like that, I think they should go 
> somewhere under the IPv6 Statistics menu, not Endpoints.

Ah okay. Got you. Thanks.

One final question; I can't seem to do name resolution with thsark on 
the mac addresses I derive from IPv6 SLAAC addresses.

So I can do this:

tshark -r ~/ipv6.pcap -2 -R 'ipv6.dst_sa_mac' -Tfields -eipv6.dst_sa_mac

or this:

tshark -Y 'ipv6.dst_sa_mac' -Tfields -eipv6.dst_sa_mac

And that results in a nice list of MAC addresses in the output.

But adding "-o 'nameres.mac_name:TRUE'" or "-Nm" does not help to cause 
manufacturer name resolution to happen on these mac addresses.

It does work for "-e eth.addr_resolved", but obviously this options 
concerns other MAC addresses.

Is what I would like to do at all possible, or is that specific use case 
something that tshark currently does not support?

Thanks.

--
Marco

Attachment: OpenPGP_signature
Description: OpenPGP digital signature

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe