ARP Observation

lab completed in dorm room 9/13

Part 1

Capture and Analyze an ARP Request

• Opened Linux VM
• Cleared ARP cache with arp -d (sudo ip -s -s neigh flush all as a backup if that doesn't work)
• Noted default gateway
• Opened Wireshark and started a capture
• Cleared ARP cache again with arp -d
• Pinged a system not in the ARP cache
• Stopped capture
• Filtered capture by arp
  • Found the ARP broadcast used to find the gateway's MAC address SCREEN CAPTURE
  • Found the ARP reply from the gateway with its MAC address SCREEN CAPTURE
• Pinged another student's system on the LAN
  • Created a display filter for ARP-only traffic (arp) and captured traffic related to neighbor's system SCREEN CAPTURE
  • Drew out the ARP request/response sequence with a neighbor by hand SCREEN CAPTURE
    • ARP 1 = my PC getting default gateway MAC address
    • ARP 2 = who has 10.0.17.14? tell 10.0.17.9 (me getting MAC of target)
    • ARP 3 = 10.0.17.14 is {MAC}
    • ARP 4 = who has 10.0.17.9? tell 10.0.17.2
    • ARP 5 = 10.0.17.9 is {MAC}
    • ARP 6 = target asks for source {MAC}
• Stopped capture, dumped ARP cache, started a new capture and pinged Google's public DNS server (8.8.8.8) as a thought experiment

Questions to consider

Q: What is the message sent in the ARP Request? What is the message sent in the ARP Reply?
A: The ARP Request is essentially the target IP address with a null MAC address — "I have this IP and no MAC address, can I get that MAC address please?" The ARP Reply is "I have a message from your target IP that its MAC address is {target MAC address}," handing the target MAC address back to the original sender.

Q: When pinging 8.8.8.8, what do you see in the ARP request and reply? Can you discern the MAC address for the Google DNS server or not?
A: The ARP request goes to the default gateway, not to 8.8.8.8 directly — ARP is a Layer 2 protocol and only works within a LAN. The computer checks whether the destination is on its local subnet; since it's not, the packet goes to the default gateway (MAC usually cached, or resolved via ARP if not), and the router forwards it from there. Google's DNS server MAC address can't be discerned this way — only the gateway's MAC ever gets resolved.