Wireshark · Wireshark-dev: Re: [Wireshark-dev] Get name resolution for IEEE 802.15.4 MAC address

[Remy Leone <remy.leone@xxxxxxxx>]

2017-05-18 9:44 GMT+02:00 Guy Harris <guy@xxxxxxxxxxxx>:

The reason is that 802.15.4 doesn't use MAC-48/EUI-48.

MAC address resolution works for non-Ethernet networks, as long as they use MAC-48/EUI-48.  "ethers" is really "mac-48s" or "eui-48s", and isn't tied to Ethernet; the name "ethers" is historical (from BSD).

Thanks. I was not aware of this. Good to know it's not tied to ethernet.

 

In order to get address-to-name resolution for EUI-64 addresses, you would:

        1) have to either add a new file for EUI-64-to-name mapping, and add code to read that file, or add to the code that reads the ethers file code to recognize EUI-64 addresses, as well as the MAC-48/EUI-48 addresses already supported, and have them build a lookup table similar to the one used for MAC-48/EUI-48 addresses;

Could you confirm that most of the work is happening in the ./epan/addr_resolv.c?

The next steps could be:

- Change the function parse_ether_address to include parsing of EUI-64 addresses 

- returning TRUE once a EUI-64 address is read. 

Is there other things I'm missing?

        2) add an "address to resolved address string" routine, and a "how long is the resolved address string for this address" routine, for EUI-64 in epan/address.c, putting pointers to those routines into eui64_address.

I suppose you are talking about ./epan/address_types.c

It seems that there is already:

eui64_addr_to_str

eui64_str_len

eui64_len

Where should I put pointers to those functions? Because there is already one defined in 

./epan/address_types.c:614

 

And to get them for short 802.15.4 addresses, you'll also have to write code to translate them, and register the "address to resolved address string" and "how long is the resolved address string for this address" routines in the address_type_dissector_register() call in epan/dissectors/packet-ieee802154.c.

I think I will only support long address at the moment. Once I got a first patch merged upstream I will see about how to extend support to long format.

Thanks a lot

Rémy