February 3rd, 2004, 10:17 PM
udp and arp help
im running a packet sniffer on my network and every once and a while i notice a udp packet that comes out of my router and is going to the netmask. is this my router trying to refresh its arp cashe. if not what is it doing?
by the way can someone please explain to me what arp poisoning is i know what it dose but i just dont understand how it works.
February 3rd, 2004, 10:18 PM
February 4th, 2004, 03:50 PM
ARP doesn't work over UDP or something so no packet you capture that is UDP or TCP is an ARP request/reply.
The above sentences are produced by the propaganda and indoctrination of people manipulating my mind since 1987, hence, I cannot be held responsible for this post\'s content
February 4th, 2004, 04:43 PM
Can you dump the output of the sniffer on here for us to look at?
Quis custodiet ipsos custodes
February 4th, 2004, 05:13 PM
If you wanna do decent sniffing, first learn the protocols so you 'll know what you're searching.
No offence, but if you don't know for.ex. that arp is a datalink-layer protocol and udp a protocol over tcp/ip, meaning ip is layer 3 ( network layer )and tcp/udp layer 4 (transmission layer) , you have no business searching for arp-poisoning. (My layer references are regarding osi-model, tcp/ip - model is a lil different)
If you understand above, you'll know el-half's answer is absolutely right ...
Anyway here's your chance to actually learn anything ...
February 5th, 2004, 08:18 PM
thx for the help with the arp poisoninbg and i fill learn more about protocals before doing anything else but any idea on what the udp packets are?
February 5th, 2004, 09:27 PM
What ports are the udp packets from/to?
I'd bet they are 67/68: bootp/dhcp broadcasts, looking for an IP lease....
Credit travels up, blame travels down -- The Boss