Printable View
im running a packet sniffer on my network and every once and a while i notice a udp packet that comes out of my router and is going to the netmask. is this my router trying to refresh its arp cashe. if not what is it doing?
by the way can someone please explain to me what arp poisoning is i know what it dose but i just dont understand how it works.
thx
ARP doesn't work over UDP or something so no packet you capture that is UDP or TCP is an ARP request/reply.
Can you dump the output of the sniffer on here for us to look at?
If you wanna do decent sniffing, first learn the protocols so you 'll know what you're searching.
No offence, but if you don't know for.ex. that arp is a datalink-layer protocol and udp a protocol over tcp/ip, meaning ip is layer 3 ( network layer )and tcp/udp layer 4 (transmission layer) , you have no business searching for arp-poisoning. (My layer references are regarding osi-model, tcp/ip - model is a lil different)
If you understand above, you'll know el-half's answer is absolutely right ...
Anyway here's your chance to actually learn anything ...
http://www.protocols.com/pbook/tcpip1.htm
thx for the help with the arp poisoninbg and i fill learn more about protocals before doing anything else but any idea on what the udp packets are?
What ports are the udp packets from/to?
I'd bet they are 67/68: bootp/dhcp broadcasts, looking for an IP lease....
Ammo