Comment 2 for bug 660904

Trent W. Buck writes "I don't know why tcpdump *wants* to access ethers(5)"

Under certain conditions the init_etherarray() function which populates address to name tables will read from /etc/ethers in an effort to be more efficient than using NIS (via /etc/nsswitch.conf.)

There is a function in tcpdump called "etheraddr_string()" which constructs a formatted string containing link-level information (i.e. MAC addresses) which is used in many places in the tcpdump code that display link-level information. If data is available that associates given names to link-level addresses etheraddr_string() can optionally use that information. That is where the tables (if any) built by init_etherarray() are (mostly?) used.