Wireshark-users: Re: [Wireshark-users] Hubs and Switches

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Wed, 4 Oct 2006 16:24:26 -0700

On Wed, Oct 04, 2006 at 06:48:59PM -0400, Usman Qureshi wrote:

> I have a questions regarding ICMP packets traversing through Hubs and 
> Switches.  If connected on a Hub I ping the broadcast address 
> (192.168.0.255) from a host machine (192.168.0.100) I get a response 
> from the address 192.168.0.1 with destination address as 
> 192.168.0.100.  How is this possible? I do not have machine with the 
> broadcast IP address.

When you ping the broadcast address, all hosts receive the packet and 
some will act as if they were pinged directly.

> On the other hand, when connected through a switch I do not get any 
> replies and only see request packets on Ethereal.

It sounds like the hub you're using has the address 192.168.0.1 if you 
no longer receive responses when using the switch.  The fact that it is a 
hub vs. switch doesn't matter because that is at layer 2 and the ping is 
operating above layer 2.


Steve