Maynard, Chris wrote: > One more thing, after alphabetizing the column choices in the last > patch I submitted, it seems to me that there are quite a few > redundancies. For example: > > 1) Hardware src addr <=> Hw src addr (resolved) > 2) Hardware dest addr <=> Hw dest addr (resolved) > 3) Source port <=> Src port (resolved) > 4) Destination port <=> Dest port (resolved)
They're not *supposed* to be the same; "Hardware src addr" is supposed to show the resolved address if MAC-layer address resolution is enabled and the unresolved address if it's not enabled. "Enabled" and "disabled" here mean enabled or disabled by the preferences file, the "-n" or "-N" flags, or the "Name resolution" item in the View menu. If that doesn't work, that's a bug. > 5) Source address <=> Src addr (resolved) <=> Network src addr <=> Net src > addr (resolved) > 6) Destination address <=> Dest addr (resolved) <=> Network dest addr <=> Net > dest addr (resolved) > 7) Src addr (unresolved) <=> Net src addr (unresolved) > 8) Dest addr (unresolved) <=> Net dest addr (unresolved) "Source address" and "destination address" fields should show the network address if the packet *has* a network address and the MAC address if the packet doesn't have a network address. If that doesn't work, that's a bug. (It works in at least one capture I have; ARP packets show the MAC source and destination address, and DHCP and OSPF packets show the IPv4 source and destination addresses. The "XXX (resolved)" versus "XXX" issues are as above. _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
