Check out these great references as well:
|Our custom profiles repository for Wireshark|
A common question I get is how can I set up a local name resolution file for IP and MAC addresses in Wireshark. The answer is it is pretty easy, but there is a big gotcha that stumps most people.
Follow this procedure:
Step 1: Open Wireshark and click Help> About Wireshark
Step 2: Click on the Folders Tab.
Step 3: Click on the hyperlink for Personal Configuration.
This will open the directory in your file navigator or Finder.
Step 4: In that directory, create a simple text file called "hosts"
Very important that this file does not have ANY extension!! If it has the .txt extension, this will not work.
Step 5: Add the relevant hosts for the file:
# This is Andy's Quick Resolution File for Wireshark
# Lines with # are comments
…and so on…
Step 6: Back in Wireshark, open a capture or do a capture. Then select View> Name Resolution> select the Enable for Network layer resolution
All of the names are now visible in all the panes.
You can do the same thing with MAC Addresses. Follow a similar procedure creating a file called "ethers".