Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it shows MAC addresses. why is that?

share|improve this question
(sorry for the syntax errors) – itayza88 Feb 19 '13 at 17:26
I'm assuming those aren't MAC addresses, they're IPv6 addresses. – Oliver Salzburg Feb 19 '13 at 17:28
I wouldn't assume that; as two answers indicate, sometimes the MAC addresses are the only source and destination addresses in the packet, and Wireshark will show them if you're showing "source address" and "destination address" columns, as opposed to "hardware" source or destination address columns that would always show the MAC address if available or "network" source or destination address columns that would show nothing of the network-layer address isn't available. MAC addresses have single octets with colons between them, like 00:01:02:03:04:05; IPv6 addresses look different. – user164970 Sep 4 '15 at 18:14 particular, they have pairs of octets with colons between them, and may have empty fields between colons, such as fe80::503b:ab83:1113:... shown in one of the answers. – user164970 Sep 4 '15 at 18:16

a protocol operating at OSI layer 2 would not be able to use an IP address (Layer3), and would instead (on Ethernet type networks) address the frame via MAC address.

share|improve this answer

I'm assuming you're seeing something like this:

enter image description here

The Source and Destination addresses are always IP addresses. The difference is that they're IPv4 and IPv6 addresses.

You can actually see the involved MAC addresses for packets of either version by looking in the details pane:

enter image description here

share|improve this answer

Not all traffic has a source and destination IP address, layer 2 protocols (such as ARP) work with just MAC addresses.

If the protocol you're seeing with just MACs isn't a layer 2 one, please post more info showing exactly which protocols/packets you're not seeing an IP for..

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .