2
1
Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it shows MAC addresses. why is that?
itayza88
Posted 2013-02-19T17:25:32.213
Reputation: 111
1
a protocol operating at OSI layer 2 would not be able to use an IP address (Layer3), and would instead (on Ethernet type networks) address the frame via MAC address.
Frank Thomas
Posted 2013-02-19T17:25:32.213
Reputation: 29 039
1
I'm assuming you're seeing something like this:
The Source and Destination addresses are always IP addresses. The difference is that they're IPv4 and IPv6 addresses.
You can actually see the involved MAC addresses for packets of either version by looking in the details pane:
Der Hochstapler
Posted 2013-02-19T17:25:32.213
Reputation: 77 228
0
Not all traffic has a source and destination IP address, layer 2 protocols (such as ARP) work with just MAC addresses.
If the protocol you're seeing with just MACs isn't a layer 2 one, please post more info showing exactly which protocols/packets you're not seeing an IP for..
rbsec
Posted 2013-02-19T17:25:32.213
Reputation: 71
I wouldn't assume that; as two answers indicate, sometimes the MAC addresses are the only source and destination addresses in the packet, and Wireshark will show them if you're showing "source address" and "destination address" columns, as opposed to "hardware" source or destination address columns that would always show the MAC address if available or "network" source or destination address columns that would show nothing of the network-layer address isn't available. MAC addresses have single octets with colons between them, like 00:01:02:03:04:05; IPv6 addresses look different. – None – 2015-09-04T18:14:22.240
...in particular, they have pairs of octets with colons between them, and may have empty fields between colons, such as fe80::503b:ab83:1113:... shown in one of the answers. – None – 2015-09-04T18:16:28.520
(sorry for the syntax errors) – itayza88 – 2013-02-19T17:26:55.427
1I'm assuming those aren't MAC addresses, they're IPv6 addresses. – Der Hochstapler – 2013-02-19T17:28:42.370