November 15th, 2005, 09:28 PM
ARP Broadcast message?
I'm learning how to use ethereal and I'm not yet familiar with some of the live traffic I'm seeing. My router seems to sending me some kind of ARP Broadcast. The Info pane says, "Who has 192.168.100.101? Tell 192.168.100.1" Then it says, "192.168.100.101 is at *mac address*"Could anyone tell me what these packets mean? Is this just part of the arp protocol? If anyone could direct me to more information about this I would be greatful!
November 15th, 2005, 09:45 PM
ARP works by broadcasting a packet to all hosts attached to a network segment. The packet contains the IP address the sending router/host is interested in communicating with. Most hosts ignore the packet. The target machine, recognizing that the IP address in the packet matches its own, returns an answer with their mac address.
Microsofts description of ARP
There are two rules for success in life:
Rule 1: Don't tell people everything you know.
November 15th, 2005, 09:48 PM
You're within the network that's probably the most common type of packet you're going to see. It's letting the hardware know how to communicate based on the logical IP address that it received, most likely from the internet. Point to point connections based on hardware require MAC addresses to communicate so whenever your router/switch gets a packet for an IP address and it doesn't know where it needs to go, it's going to ask so it can determine the port to send it out on. Oh, and it has to broadcast it because obviously it doesn't where to send it if it's asking.
here is a better explanation than I can provide. more colorful pictures too.
"Experience is the hardest teacher, it gives the test first and the lesson after." Anonymous