Using the statistics – resolved addresses

In this recipe, we will learn a new feature of Wireshark version 2: DNS translations of the captured IP addresses, along with a list of well-known TCP/UDP ports and Ethernet (MAC) addresses vendors.

Getting ready

Start Wireshark, click on Statistics.

How to do it...

From the Statistics menu, choose Resolved Addresses. You will get the following window:

In this window, you have the following information:

• Address resolution, which provides DNS names of the captured IP addresses. You can also check Comment if you want comments to be seen.
• The Hash tables are hash values of the IP addresses.
• Port names (services), Ethernet Addresses, Ethernet Manufacturers, and Ethernet Well-Known Addresses provide Ethernet address information.

How it works...

For IP addresses, Wireshark simply uses your laptop's resolving mechanisms, which are DNS and the Wireshark hosts file, located in the Wireshark home directory.

For the MAC manufacturers, Wireshark uses MAC address translations...